UAC-0226 GIFTEDCROOK Reflective PE Load via WC3/wt1 Staging Files

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

This rule detects malicious activity associated with the GIFTEDCROOK (UAC-0226) threat actor. It identifies the use of PowerShell or cmd.exe to execute staged files from specific ProgramData paths (WC3, wt1), monitors for common NT API-based reflective injection patterns (such as NtAllocateVirtualMemory and NtWriteVirtualMemory) originating from PowerShell, tracks the creation of known staging artifacts in ProgramData, and identifies the execution of known malicious process image hashes.