Suspicious Get-Variable.exe Creation
Get-Variable is a valid PowerShell cmdlet WindowsApps is by default in the path where PowerShell is executed. So when the Get-Variable command is issued on PowerShell execution, the system first looks for the…
Description
Get-Variable is a valid PowerShell cmdlet WindowsApps is by default in the path where PowerShell is executed. So when the Get-Variable command is issued on PowerShell execution, the system first looks for the Get-Variable executable in the path and executes the malicious binary instead of looking for the PowerShell cmdlet.
Detection logic
Detection requirements
- Platform
- ESXiIaaSLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows
The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.
- Log source product
- windows
- Log source category
- file_event
Known benign triggers
- Unknown
MITRE ATT&CK mappings
0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.
References
| Reference | Cited by |
|---|---|
| blog.malwarebytes.com/threat-intelligence/2022/04/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique/ | 2 |
| www.joesandbox.com/analysis/465533/0/html | Only this detection cites it |
From the source
- At source
- Open at source
- Upstream identifier
- 0c3fac91-5627-46e8-a6a8-a0d7b9b8ae1b
- Tagged by the source as
- attack.persistenceattack.privilege-escalationattack.stealth
Licence
- Published under
- Detection Rule License 1.1Read the licence
- Attribution
- Required
Authorship
- Written by
- Published
- Aug 26, 2026
- Version
- 1