Tag
medium
threat
Abuse of PowerShell Search Path via WindowsApps Folder
1 rule 1 TTPAttackers can achieve persistence by placing a malicious 'Get-Variable.exe' binary into the WindowsApps folder to hijack PowerShell command execution, a technique observed in the wild by the Colibri malware.
Windows
Colibri
persistence
privilege-escalation
powershell
1r
1t
high
advisory
Get-Variable.exe Hijacking for Persistence
2 rules 1 TTPAttackers can establish persistence by placing a malicious Get-Variable.exe in the WindowsApps folder, hijacking the legitimate PowerShell cmdlet and executing upon PowerShell window initialization, as seen with the Colibri malware.
Splunk Enterprise +2
persistence
powershell
windowsapps
colibri
2r
1t