Skip to content
Threat Feed

Tag

Windowsapps

1 brief RSS
high advisory

Get-Variable.exe Hijacking for Persistence

Attackers can establish persistence by placing a malicious Get-Variable.exe in the WindowsApps folder, hijacking the legitimate PowerShell cmdlet and executing upon PowerShell window initialization, as seen with the Colibri malware.

Splunk Enterprise +2 persistence powershell windowsapps colibri
2r 1t