UAC-0226 Startup LNK Double-PowerShell Chain via cmd.exe (GIFTEDCROOK)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

This rule detects a multi-stage execution chain indicative of malicious LNK files placed in startup folders. It tracks the sequence starting with explorer.exe spawning cmd.exe (with /min switch), followed by a child powershell.exe utilizing common evasion flags, and concluding with a grandchild powershell.exe executing suspicious commands such as encoded commands, IEX, or referencing the ProgramData directory, all within a 10-minute window.