get-comspec-environment-variable.yml

rule:
  meta:
    name: get COMSPEC environment variable
    namespace: host-interaction/environment-variable
    author: matthew.williams@mandiant.com
    scope: function
    att&ck:
      - Discovery::System Information Discovery [T1082]
    mbc:
      - Operating System::Environment Variable::Get Variable [C0034.002]
    examples:
      - Practical Malware Analysis Lab 14-02.exe_:0x401880
  features:
    - and:
      - match: query environment variable
      - or:
        - string: "COMSPEC"
        - string: "%COMSPEC%"