UAC-0226 GIFTEDCROOK WC3 PowerShell Reflective Loader Script
Detects the UAC-0226 WC3 PowerShell loader script which utilizes .NET reflection to resolve native NT APIs for the reflective injection of the GIFTEDCROOK payload into memory. The loader exhibits behavioral indicators such as file staging in ProgramData, sandbox evasion via sleep commands, and the definition of RWX memory permissions.
YARA
