UAC-0226 GIFTEDCROOK Staging Directory, ZIP Archive, and TEMP Marker Creation

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•5

Detects suspicious file activity associated with the GIFTEDCROOK (UAC-0226) threat actor. The rule identifies the creation of randomized staging directories under the user profile, the creation of ZIP archives in the user root, and the creation of extensionless files within the Windows TEMP directory.