MovieReaper Stage 3 msedge.exe Masquerade in Telemetry Folder

Arnold Chan@slaz

•updated 21 days ago•0•0•0

Detects instances where the 'msedge.exe' binary is executed from the non-standard path 'C:\ProgramData\Microsoft\Windows\Telemetry\', excluding instances initiated by the legitimate Microsoft Edge Update process. This pattern often indicates masquerading, where an adversary places a malicious file with a legitimate name in an attempt to evade detection.