GIFTEDCROOK Reflective PE Load via PowerShell Native NT API Calls

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

This rule detects sophisticated PowerShell activity involving reflective code loading and suspicious process interaction. It identifies three distinct patterns: malicious script execution using Invoke-Expression (IEX) on files within ProgramData, PowerShell script blocks utilizing low-level NT APIs (such as NtAllocateVirtualMemory and NtCreateThreadEx) often associated with reflective injection, and suspicious cross-process remote thread creation by PowerShell processes.