Bruteforce scan for URLs in Edge folders

Windows.Applications.EdgeUrls.yaml

name: Windows.Applications.EdgeUrls
description: |
   Scan anything that looks like a URL in Edge folders.
   
parameters:
- name: EdgeGlob
  default: C:/Users/*/AppData/Local/Packages/Microsoft.MicrosoftEdge_*/**
- name: URLYaraRule
  default: |
    rule URL { 
      strings: $a = /https?:\/\/[a-z0-9\/+&#:\?.-]+/i  
      condition: any of them
    }

sources:
- queries:
    - SELECT * FROM foreach(
         row={ 
             SELECT FullPath FROM glob(globs=EdgeGlob)
         }, query={ 
             SELECT str(str=String.Data) AS Hit, 
                    String.Offset AS Offset, 
                    FileName 
             FROM yara(files=FullPath, rules=URLYaraRule)
         })