New Expected Path about threat-hunting-and-detection HOT 4 CLOSED

I haven't seen this libraries loaded by msedge in my lab. Could it be something custom to the environment?

from threat-hunting-and-detection.

It's a known alternate location for the files. And judging by the logic of the query I think the reason it's listed Suspicious is because it's location is not added to Expected locations, not because it's unusual to be loaded by Edge.
https://www.file.net/process/wbemprox.dll.html

from threat-hunting-and-detection.

I can see Edge is one of the expected programs listed as using this libraries (andalso possible target for hijacking)
Here:
https://hijacklibs.net/entries/microsoft/built-in/wbemprox.html

from threat-hunting-and-detection.

I've synced the csf file. Let me know if it doesn't work.

from threat-hunting-and-detection.