GIFTEDCROOK Reflective Loader: PowerShell NT API Resolution via .NET Reflection with ProgramData Read

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

This rule detects potentially malicious PowerShell behavior by correlating two events within a 5-minute window: first, a PowerShell process reading files from the C:\ProgramData directory, and second, the same process invoking sensitive memory manipulation APIs (e.g., NtAllocateVirtualMemory, NtCreateThreadEx, GetDelegateForFunctionPointer). This pattern is commonly associated with fileless malware loaders or staging scripts that read encrypted payloads from disk and execute them in memory.