GIFTEDCROOK UAC-0226 Byte-Subtract Decode and Reflective NT API Execution in PowerShell

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

Detects PowerShell scripts attempting to perform memory injection by utilizing native Windows API calls (e.g., NtAllocateVirtualMemory, NtProtectVirtualMemory, NtCreateThreadEx) alongside memory manipulation patterns such as byte manipulation and the use of System.Runtime.InteropServices.Marshal.