Fake MicrosoftEdgeUpdateTask spawns headless encoded PowerShell

Ibrahim Saud@tektrix

•updated Sep 20, 2026•1•0•3

Detects the execution of PowerShell with encoded commands in headless mode, associated with the Microsoft Edge Update Task (MicrosoftEdgeUpdateTaskUserS-1-5-24). This pattern is indicative of potential malicious activity where legitimate update tasks are abused to run obfuscated scripts.