SNOWBELT VAPID public key push notification registration
Detects network, process, and file activity referencing the specific hard-coded VAPID public key used by SNOWBELT in the UNC6692/Edgecution campaign for push-notification-based registration, correlating browser extension file drops (background.js, extension.log) with the key's appearance in network traffic or process command lines.
Microsoft Sentinel (KQL)
