UAC-0226 GIFTEDCROOK PowerShell SSL Bypass and High-Port C2 Network

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•7

This rule detects two suspicious behaviors associated with PowerShell: 1) attempts to disable SSL/TLS certificate validation (often used by malicious scripts to bypass security checks when downloading payloads) and 2) outbound network connections by non-Microsoft signed processes on non-standard ports (8000-9000), which is common in C2 beaconing activities.