APT36 Fake Edge Update Task Runs Encoded PowerShell to indiatodays[.]org

Ibrahim Saud@tektrix

•updated Sep 20, 2026•0•0•1

Detects instances where PowerShell is executed with encoded commands, seemingly spawned by a process masquerading as or related to the Microsoft Edge Update Task. The rule specifically monitors for process chains involving 'conhost.exe' with '--headless' arguments and subsequent PowerShell execution containing encoded commands, often associated with obfuscated activity.