Edgecution native host: random txt file created and deleted in close succession
Detects short-lived, randomly-named .txt files (15-30 lowercase letters) created and then deleted within 5 minutes by python.exe or pythonw.exe processes in a folder path containing "native", consistent with the Edgecution native messaging host component using temporary text files as a queue/log for C2 command exchange.
Microsoft Sentinel (KQL)
