UAC-0226 Startup LNK Launching Hidden PowerShell IEX Chain from ProgramData
Detects persistence mechanisms associated with the UAC-0226 threat actor by identifying a LNK shortcut file located in the user Startup folder that executes a minimized cmd.exe process. This command shell subsequently launches a hidden PowerShell command that reads and executes code from C:\ProgramData\WC3 using Invoke-Expression (IEX). This activity is linked to the GIFTEDCROOK delivery chain.
Microsoft Sentinel (KQL)
