UAC-0226 GIFTEDCROOK Staged PE Executed from C:\ProgramData Within 2 Minutes of Drop

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

Detects instances where PowerShell or cmd.exe drops an executable file (or extensionless file) into the C:\ProgramData directory, followed by the execution of that same file within a 2-minute window. This behavior is associated with the UAC-0226 campaign (GIFTEDCROOK loader chain) for staging malicious payloads.