UAC-0226 GIFTEDCROOK WC3 PowerShell Reflective NT API Loader

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

Detects obfuscated PowerShell command lines executing code from a staging file located at C:\ProgramData\WC3. The rule targets execution patterns where Get-Content is used in conjunction with Invoke-Expression (IEX) to reflectively load a PE file, leveraging native NT API resolution via Microsoft.Win32.UnsafeNativeMethods, consistent with activity attributed to the UAC-0226 GIFTEDCROOK campaign.