sigmahighHunting

Suspicious Creation with Colorcpl

Once executed, colorcpl.exe will copy the arbitrary file to c:\windows\system32\spool\drivers\color\

MITRE ATT&CK

defense-evasion

Detection Query

selection:
  Image|endswith: \colorcpl.exe
filter_ext:
  TargetFilename|endswith:
    - .icm
    - .gmmp
    - .cdmp
    - .camp
condition: selection and not 1 of filter_*

Author

frack113

Created

2022-01-21

Data Sources

windowsFile Events

Platforms

windows

References

https://twitter.com/eral4m/status/1480468728324231172?s=20

Tags

attack.defense-evasionattack.t1564

Raw Content

title: Suspicious Creation with Colorcpl
id: e15b518d-b4ce-4410-a9cd-501f23ce4a18
status: test
description: Once executed, colorcpl.exe will copy the arbitrary file to c:\windows\system32\spool\drivers\color\
references:
    - https://twitter.com/eral4m/status/1480468728324231172?s=20
author: frack113
date: 2022-01-21
modified: 2023-01-05
tags:
    - attack.defense-evasion
    - attack.t1564
logsource:
    product: windows
    category: file_event
detection:
    selection:
        Image|endswith: '\colorcpl.exe'
    filter_ext:
        TargetFilename|endswith:
            - '.icm'
            - '.gmmp'
            - '.cdmp'
            - '.camp'
    condition: selection and not 1 of filter_*
falsepositives:
    - Unknown
level: high