MovieReaper Stage-3 UAC Bypass: msedge.exe Masquerade in Telemetry Path

Ibrahim Saud@tektrix

•updated 22 days ago•0•0•1

Detects the execution of a file named 'msedge.exe' residing within the C:\ProgramData\Microsoft\Windows\Telemetry\ directory. Microsoft Edge typically resides in 'C:\Program Files (x86)\Microsoft\Edge\Application\', making execution from the telemetry directory highly suspicious and indicative of potential process masquerading.