GIFTEDCROOK C2 Beacon: PowerShell/CMD Outbound to UAC-0226 Infrastructure on Non-Standard Port

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

This rule detects network connections initiated by common Windows command-line utilities (powershell.exe, pwsh.exe, cmd.exe) to suspicious remote IP addresses or non-standard ports. It specifically flags known Command and Control (C2) IPs and atypical network ports to identify potential adversary activity like staging or communication.