UnCanny Coercion - Suspicious Plugin Fulfillment ID

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•2

Detects PowerShell executing the CreateInstallServiceWork function with a custom FulfillmentPluginId, which is indicative of the UnCanny coercion technique.