Windows Command Obfuscation with Environment Variable Substrings — Detection Rule
Detects command obfuscation by using a technique to build a target command using character indexes from environment variables. This hides the true intent of the command by building it on the fly. In Windows command prompt, you can use the :~ format to extract substrings from environment variable values. This behavior has been observed in various malware families, including Cobalt Strike and Meterpreter.