UAC-0226 GIFTEDCROOK Reflective NT API Loading via PowerShell

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•6

Detects the use of .NET reflection within PowerShell to resolve and invoke native Windows APIs (e.g., NtAllocateVirtualMemory, NtCreateThreadEx) typically used by the GIFTEDCROOK actor to perform in-memory shellcode or PE loading. The rule searches for command line patterns combining native API names with reflection-related keywords.