Edgecution native_host.py python process writing files to non-standard Edge/ProgramData paths
Detects instances where Microsoft Edge (msedge.exe) initiates a python.exe process that executes 'native_host.py' (associated with the Edgecution malware suite) and subsequently writes files to sensitive or non-standard directories such as ProgramData or Edge recovery folders. This activity is indicative of the malware's native messaging host persistence, staging, or data exfiltration mechanisms.
Microsoft Sentinel (KQL)
