{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/actors/colibri/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["Colibri"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Windows"],"_cs_severities":["medium"],"_cs_tags":["persistence","privilege-escalation","powershell","colibri"],"_cs_type":"threat","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eThis threat involves the exploitation of the Windows search path mechanism to execute malicious code by hijacking the 'Get-Variable' PowerShell cmdlet. By placing a malicious executable named 'Get-Variable.exe' within the '%LocalAppData%\\Microsoft\\WindowsApps\\' directory, an attacker can ensure their binary is executed whenever PowerShell is invoked. Because the WindowsApps folder is included in the system's PATH, PowerShell will prioritize the malicious binary over the legitimate system functions under certain conditions. This technique, identified as T1574.008, allows for persistent code execution and has been observed in campaigns utilizing the Colibri malware. The primary concern for defenders is that this behavior often occurs when PowerShell windows are initialized, such as through legitimate scheduled tasks, masking the malicious activity behind normal system operations.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker gains initial access to the target endpoint via phishing or secondary exploitation.\u003c/li\u003e\n\u003cli\u003eThe attacker navigates to the user's local AppData path: %LocalAppData%\\Microsoft\\WindowsApps\\.\u003c/li\u003e\n\u003cli\u003eThe attacker drops a malicious binary named 'Get-Variable.exe' into this directory.\u003c/li\u003e\n\u003cli\u003eThe attacker establishes a persistence mechanism, such as a scheduled task, designed to trigger a PowerShell process.\u003c/li\u003e\n\u003cli\u003eThe system or user triggers the scheduled task or launches a new PowerShell instance.\u003c/li\u003e\n\u003cli\u003ePowerShell resolves the 'Get-Variable' request by locating and executing the malicious 'Get-Variable.exe' in the WindowsApps folder.\u003c/li\u003e\n\u003cli\u003eThe malicious code executes with the context of the calling PowerShell process, completing the persistence or privilege escalation cycle.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe primary impact is the establishment of persistent, unauthorized code execution that survives system reboots and user logoffs. This technique can be used for privilege escalation and provides a stealthy foothold for additional stages of a campaign. It has been documented in active campaigns involving the Colibri malware, which can lead to data exfiltration or the deployment of additional payloads.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eDeploy the Sigma rule provided in this brief to monitor for the creation or execution of executables within the WindowsApps folder that deviate from standard naming conventions.\u003c/li\u003e\n\u003cli\u003eImplement EDR telemetry monitoring for 'Get-Variable.exe' process creation events (Sysmon Event ID 1 or Windows Event 4688) specifically originating from the WindowsApps path.\u003c/li\u003e\n\u003cli\u003eAudit the '%LocalAppData%\\Microsoft\\WindowsApps\\' directory for unauthorized or unrecognized executables.\u003c/li\u003e\n\u003cli\u003eUse the provided process-creation logs to verify the parent process, ensuring that legitimate administrative tools are not incorrectly flagged.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-12T18:07:37Z","date_published":"2026-10-12T18:07:37Z","id":"https://feed.craftedsignal.io/briefs/2026-10-windows-get-variable-hijacking/","summary":"Attackers can achieve persistence by placing a malicious 'Get-Variable.exe' binary into the WindowsApps folder to hijack PowerShell command execution, a technique observed in the wild by the Colibri malware.","title":"Abuse of PowerShell Search Path via WindowsApps Folder","url":"https://feed.craftedsignal.io/briefs/2026-10-windows-get-variable-hijacking/"}],"language":"en","title":"CraftedSignal Threat Feed - Colibri","version":"https://jsonfeed.org/version/1.1"}