UAC-0226 GIFTEDCROOK Startup LNK cmd.exe->PowerShell IEX ProgramData Chain

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•8

Detects a suspicious process execution chain where explorer.exe or userinit.exe spawns cmd.exe, which in turn launches PowerShell to execute a hidden, bypassed, and obfuscated script involving content retrieval from the C:\ProgramData directory. This pattern is characteristic of the UAC-0226 GIFTEDCROOK actor's persistence mechanism using LNK files.