fix get-variable hijack

mandiant · Dec 2, 2024 · 1a77ae1 · 1a77ae1
1 parent d132d84
commit 1a77ae1
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/nursery/persist-via-get-variable-hijack.yml b/nursery/persist-via-get-variable-hijack.yml
@@ -13,5 +13,8 @@ rule:
       - https://www.threatdown.com/blog/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique/
   features:
     - and:
-      - match: persist via host software binary compromise
+      - or:
+        - match: copy file
+        - match: move file
+        - match: write file on Windows
       - string: /Microsoft\\WindowsApps\\Get-Variable.exe/i