UAC-0226 Startup LNK Spawning Hidden PowerShell Chain to IEX C:\ProgramData\WC3

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

Detects a suspicious execution chain where a command prompt (cmd.exe) launched from a Startup LNK context initiates a hidden PowerShell process with Execution Policy bypass flags. This pattern is often associated with fileless malware execution, specifically linked to UAC-0226 activity, aiming to execute obfuscated PowerShell scripts by reading payloads from memory or staged files.