Suspicious Drop Binaries Into Spool Drivers Color Folder (via file_event)

title: Suspicious Drop Binaries Into Spool Drivers Color Folder (via file_event)
id: 2a9dc473-e936-57b9-b78a-4544d2537546
status: stable
description: This rule detects the creation of suspcious binary files inside the "\windows\system32\spool\drivers\color\" as seen in the blog referenced below
references:
    - https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/
author: Huntrule Team
date: 2026-06-23
tags:
    - attack.stealth
    - attack.defense-evasion
    - attack.t1036
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|startswith: 'C:\Windows\System32\spool\drivers\color\'
        TargetFilename|endswith:
            - '.dll'
            - '.exe'
            - '.sys'
    condition: selection
falsepositives:
    - Unknown
level: medium