UAC-0226 GIFTEDCROOK NT API Resolution in PowerShell Followed by C2 Connection
This rule detects potentially malicious PowerShell activity involving memory injection techniques (e.g., NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx) occurring in conjunction with outbound network connections within a 5-minute window, which is indicative of command-and-control behavior.
Microsoft Sentinel (KQL)
