Windows File Creation: Suspicious DLL/EXE/SYS in Spool Drivers Color Folder
Alerts on creation of .dll, .exe, or .sys files under C:\Windows\System32\spool\drivers\color.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-07-28
- Updated
- 2026-07-31
What it detects
This rule flags file creation events where the target path begins with C:\Windows\System32\spool\drivers\color\ and the created file name ends with .dll, .exe, or .sys. Dropping binaries into this Windows spool driver directory can support execution or persistence by placing attacker-controlled modules in a trusted-looking location. The detection relies on Windows file event telemetry capturing the created file path and extension.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-suspicious-dll-exe-sys-creation-in-spool-drivers-color-folder-ce7066a6
title: "Windows File Creation: Suspicious DLL/EXE/SYS in Spool Drivers Color Folder"
id: 6c1662c1-2e15-446f-8fca-3dff27929973
status: test
description: This rule flags file creation events where the target path begins with C:\Windows\System32\spool\drivers\color\ and the created file name ends with .dll, .exe, or .sys. Dropping binaries into this Windows spool driver directory can support execution or persistence by placing attacker-controlled modules in a trusted-looking location. The detection relies on Windows file event telemetry capturing the created file path and extension.
references:
- https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_spool_drivers_color_drop.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-28
tags:
- attack.stealth
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename|startswith: C:\Windows\System32\spool\drivers\color\
TargetFilename|endswith:
- .dll
- .exe
- .sys
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: ce7066a6-508a-42d3-995b-2952c65dc2ce
type: derived