UAC-0226 cmd start /min PowerShell IEX Get-Content ProgramData Loader Chain

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

Detects a sequence where a command shell (cmd.exe) is launched with minimized window flags to run PowerShell, followed by a PowerShell process executing code using common file-less loading techniques, specifically using Invoke-Expression (iex) on content retrieved via Get-Content from within the ProgramData directory.