Windows File Creation of Suspicious Get-Variable.exe Under WindowsApps

title: Windows File Creation of Suspicious Get-Variable.exe Under WindowsApps
id: 2f284233-8ea5-4be7-b03d-4fe13a89ab5f
status: test
description: This rule flags creation of a file named Get-Variable.exe specifically under Local\Microsoft\WindowsApps, a location where a Get-Variable executable could be prioritized over the PowerShell cmdlet. Attackers may abuse this path-based execution behavior to run a malicious binary when scripts or users call Get-Variable. Detection relies on Windows file creation telemetry for the target filename and full path.
references:
  - https://blog.malwarebytes.com/threat-intelligence/2022/04/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique/
  - https://www.joesandbox.com/analysis/465533/0/html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_get_variable.yml
author: frack113, Huntrule Team
date: 2022-04-23
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.stealth
  - attack.t1546
  - attack.t1027
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|endswith: Local\Microsoft\WindowsApps\Get-Variable.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 0c3fac91-5627-46e8-a6a8-a0d7b9b8ae1b
    type: derived