Windows Get-Variable.EXE Execution from WindowsApps Folder

An attacker can obtain persistence by hijacking the PowerShell cmdlet 'Get-Variable' by placing Get-Variable.exe in the WindowsApps folder, which is part of the PowerShell path. Whenever a PowerShell window is opened via a scheduled task, the malicious Get-Variable.exe will be run. This activity was first associated with the Colibri malware.