Detectionhightest
Suspicious Creation with Colorcpl
Once executed, colorcpl.exe will copy the arbitrary file to c:\windows\system32\spool\drivers\color\
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Log Source
WindowsFile Event
ProductWindows← raw: windows
CategoryFile Event← raw: file_event
Events for file system activity including creation, modification, and deletion.
Detection Logic
Detection Logic2 selectors
detection:
selection:
Image|endswith: '\colorcpl.exe'
filter_ext:
TargetFilename|endswith:
- '.icm'
- '.gmmp'
- '.cdmp'
- '.camp'
condition: selection and not 1 of filter_*False Positives
Unknown
False positive likelihood has not been assessed. Additional context may be needed during triage.
References
MITRE ATT&CK
Tactics
Techniques
Rule Metadata
Rule ID
e15b518d-b4ce-4410-a9cd-501f23ce4a18
Status
test
Level
high
Type
Detection
Created
Fri Jan 21
Modified
Thu Jan 05
Author
Path
rules/windows/file/file_event/file_event_win_susp_colorcpl.yml
Raw Tags
attack.defense-evasionattack.t1564