UNC6692 SNOWBELT Edge Cleanup Task
Detects the execution of a specific command line utilizing tasklist and taskkill to identify and terminate msedge.exe processes that do not have CoreUIComponents.dll loaded. This defense evasion technique is heavily utilized by UNC6692 via scheduled tasks to clean up headless Microsoft Edge processes executing their SNOWBELT malware.
Sigma
