Windows File Creation: Suspicious DLL/EXE/SYS in Spool Drivers Color Folder

Alerts on creation of .dll, .exe, or .sys files under C:\Windows\System32\spool\drivers\color.

FreeReviewedSigma · Medium · v2
Product
windows
Category
file_event
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-07-28
Updated
2026-07-31

What it detects

This rule flags file creation events where the target path begins with C:\Windows\System32\spool\drivers\color\ and the created file name ends with .dll, .exe, or .sys. Dropping binaries into this Windows spool driver directory can support execution or persistence by placing attacker-controlled modules in a trusted-looking location. The detection relies on Windows file event telemetry capturing the created file path and extension.

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.