Toast Notification XML with Protocol Action Button Constructed via PowerShell

Bryant Smith@flowstate

•updated Mar 25, 2026•0•29

Detects PowerShell constructing toast notification XML containing an activationType attribute combined with a protocol scheme. This pattern creates a clickable notification button that launches a URI handler, the primary mechanism for delivering phishing links via toast notifications. Covers both msteams:// protocol links and generic protocol handlers.