Windows Suspicious DLL/EXE/SYS Creation in Spool Drivers Color Folder

title: Windows Suspicious DLL/EXE/SYS Creation in Spool Drivers Color Folder
id: 6c1662c1-2e15-446f-8fca-3dff27929973
status: test
description: This rule flags creation events where a file path begins with C:\Windows\System32\spool\drivers\color\ and the created file ends with .dll, .exe, or .sys. Dropping executable or driver binaries into spool driver directories can support stealthy execution and persistence by placing malicious components in a location associated with system drivers. The detection relies on Windows file event telemetry that provides the target file path and filename extension.
references:
  - https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_spool_drivers_color_drop.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-28
tags:
  - attack.stealth
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|startswith: C:\Windows\System32\spool\drivers\color\
    TargetFilename|endswith:
      - .dll
      - .exe
      - .sys
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: ce7066a6-508a-42d3-995b-2952c65dc2ce
    type: derived