Hackers make FAKE notifications

A walkthrough demonstrating how attackers can create fake Windows toast notifications using PowerShell and WinRT APIs to impersonate trusted applications like Windows Defender or Microsoft Edge. The technique involves querying the Windows registry for Application User Model IDs (AUMIDs), constructing XML-based toast notifications, and optionally adding interactive buttons that open attacker-controlled URLs or trigger code execution via custom protocol handlers. The post also covers detection methods including ETW providers, Sysmon event IDs, and Sigma rules, and references purple team resources for defenders.