Skip to content
Threat Feed
Subscribe

Actor

Colibri

1 brief RSS
medium threat

Abuse of PowerShell Search Path via WindowsApps Folder

Attackers can achieve persistence by placing a malicious 'Get-Variable.exe' binary into the WindowsApps folder to hijack PowerShell command execution, a technique observed in the wild by the Colibri malware.

Windows Colibri persistence privilege-escalation powershell
1r 1t