Windows: Suspicious colorcpl.exe file creation/copy to System32 spool drivers color

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1564Hide Artifacts
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags executions of colorcpl.exe when it creates or copies files whose target filenames end with .icm, .gmmp, .cdmp, or .camp. Such operations can be used to stage or persist artifacts in sensitive Windows directories, making the targeted filename extensions important for attacker tradecraft. It relies on Windows file event telemetry, matching the process image name ending in \colorcpl.exe and the target filename extension from the file event.

Reporting behind it

Related detections9 linkedT1564 — drag to rearrange

Suspicious Windows Security Spoofing via pin Executable Writing output.txt via process_creation

Obfuscated Extended Rights Backdoor Obfuscation - Via localizationDisplayId Attribute (via security)

Suspicious Process Execution from Public User Media Folders via process_creation

Suspicious Windows Sandbox Configuration Execution for AsyncRAT via Process Creation

System Informer Execution on Windows Process Creation

Linux mount executed with hidepid=2 option

Windows Process Hacker Execution Identified by Image Metadata and Hashes

Windows File Events: Suspicious Executable File Name Creation

Windows: Suspicious Parent Process Execution From \Users\Public Spawning Scripting/Shell Binaries

Windows: Suspicious colorcpl.exe file creation/copy to System32 spool drivers color

Pivot detection · T1564 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-suspicious-colorcpl-exe-file-creation-targeting-system32-spool-drivers-p-e15b518d

title: "Windows: Suspicious colorcpl.exe file creation/copy to System32 spool drivers color"
id: 35d0ae5b-84c4-4324-9239-abe263cbce59
status: test
description: This rule flags executions of colorcpl.exe when it creates or copies files whose target filenames end with .icm, .gmmp, .cdmp, or .camp. Such operations can be used to stage or persist artifacts in sensitive Windows directories, making the targeted filename extensions important for attacker tradecraft. It relies on Windows file event telemetry, matching the process image name ending in \colorcpl.exe and the target filename extension from the file event.
references:
  - https://twitter.com/eral4m/status/1480468728324231172?s=20
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_colorcpl.yml
author: frack113, Huntrule Team
date: 2022-01-21
modified: 2023-01-05
tags:
  - attack.stealth
  - attack.t1564
logsource:
  product: windows
  category: file_event
detection:
  selection:
    Image|endswith: \colorcpl.exe
  filter_ext:
    TargetFilename|endswith:
      - .icm
      - .gmmp
      - .cdmp
      - .camp
  condition: selection and not 1 of filter_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: e15b518d-b4ce-4410-a9cd-501f23ce4a18
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL