UAC-0226 GIFTEDCROOK WC3 Loader: PowerShell IEX Get-Content ProgramData No-Ext

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•5

Detects the use of PowerShell to read files from the C:\ProgramData directory using the -Raw parameter, followed by the execution of the content via Invoke-Expression (iex). This pattern is often used to execute obfuscated payloads stored in non-standard locations while bypassing basic execution constraints.