UAC-0226 GIFTEDCROOK Reflective PE Load via PowerShell NtProtectVirtualMemory

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•4

Detects reflective PE loading behavior potentially associated with the GIFTEDCROOK malware family. The rule monitors PowerShell processes that interact with the Windows API NtProtectVirtualMemory to set memory pages to PAGE_EXECUTE_READWRITE (0x40), a common technique for staging and executing shellcode in process memory.