WinRT Toast Notification API Loaded via PowerShell

Bryant Smith@flowstate

•updated Mar 25, 2026•0•37

Detects PowerShell script blocks loading the WinRT ToastNotificationManager API or using the ContentType=WindowsRuntime type accelerator syntax. Used by attackers to programmatically send fake toast notifications impersonating legitimate applications such as Microsoft Edge, Teams, or Windows Security.