Suspicious Execution Gate Variable Creation
Detects the creation or setting of the specific environment variable 'ALLUSERSPROFILE_X'. This variable is used as a mandatory execution gate by a malware campaign delivering Amatera Stealer to ensure that the initial user-assisted execution step was completed.
Sigma
