Lunex com.lunex.explorer Native Messaging Host PowerShell backdoor

Arnold Chan@slaz

•updated Sep 27, 2026•0•0•3

Detects the persistence and execution mechanism of the Lunex Native Messaging Host backdoor. The rule identifies the registration of the 'com.lunex.explorer' native messaging host registry key and the subsequent invocation of PowerShell scripts from browser processes (chrome.exe or msedge.exe) containing specific backdoor command arguments like 'list_drives' or 'run'.