UAC-0226 GIFTEDCROOK: WinRAR ADS LNK Drop -> CMD /min -> PowerShell IEX WC3 Chain

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

This rule detects a multi-stage attack sequence starting with WinRAR creating an LNK file in the Windows Startup directory for persistence, followed by the execution of a minimized command prompt, and finally a PowerShell script executing hidden content from the ProgramData directory using IEX (Invoke-Expression).