Scheduled task hunts headless Edge via SHELL32/CoreUIComponents.dll checks and taskkill
Detects a pattern where a process enumerates running processes via tasklist looking for msedge.exe with SHELL32.dll or CoreUIComponents.dll modules loaded, followed within 5 minutes by a taskkill /F /PID command against that process, initiated by svchost.exe, taskeng.exe, python.exe, pythonw.exe, powershell.exe, or a process invoked via native_host.py. This behavior matches Edgecution's technique of detecting a running headless Edge instance and terminating it before relaunching, as observed in the UNC6692 campaign.
Microsoft Sentinel (KQL)
