Windows: Suspicious colorcpl.exe file creation targeting System32 spool drivers path

Alerts on colorcpl.exe creating files in C:\Windows\System32\spool\drivers\color\ with suspicious target filenames.

FreeUnreviewedSigmahighv1

windows-suspicious-colorcpl-exe-file-creation-targeting-system32-spool-drivers-p-e15b518d

title: "Windows: Suspicious colorcpl.exe file creation targeting System32 spool drivers path"
id: 35d0ae5b-84c4-4324-9239-abe263cbce59
status: test
description: This rule flags events where colorcpl.exe executes and creates or writes files to the Windows system spool drivers color directory. Attackers can abuse legitimate Windows binaries to stage or hide files in trusted system locations, reducing the visibility of malicious activity. Detection relies on Windows file event telemetry matching colorcpl.exe execution and the created/target filename behavior, further narrowing results by excluding specific extension types.
references:
  - https://twitter.com/eral4m/status/1480468728324231172?s=20
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_colorcpl.yml
author: frack113, Huntrule Team
date: 2022-01-21
modified: 2023-01-05
tags:
  - attack.stealth
  - attack.t1564
logsource:
  product: windows
  category: file_event
detection:
  selection:
    Image|endswith: \colorcpl.exe
  filter_ext:
    TargetFilename|endswith:
      - .icm
      - .gmmp
      - .cdmp
      - .camp
  condition: selection and not 1 of filter_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: e15b518d-b4ce-4410-a9cd-501f23ce4a18
    type: derived

What it detects

This rule flags events where colorcpl.exe executes and creates or writes files to the Windows system spool drivers color directory. Attackers can abuse legitimate Windows binaries to stage or hide files in trusted system locations, reducing the visibility of malicious activity. Detection relies on Windows file event telemetry matching colorcpl.exe execution and the created/target filename behavior, further narrowing results by excluding specific extension types.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.