{"id":"e15b518d-b4ce-4410-a9cd-501f23ce4a18","title":"Suspicious Creation with Colorcpl","description":"Once executed, colorcpl.exe will copy the arbitrary file to c:\\windows\\system32\\spool\\drivers\\color\\","author":"frack113","status":"test","level":"high","date":"2022-01-21","modified":"2023-01-05","tags":["attack.stealth","attack.t1564"],"technique_ids":["T1564"],"logsource":{"product":"windows","category":"file_event"},"falsepositives":["Unknown"],"references":["https://twitter.com/eral4m/status/1480468728324231172?s=20"],"source_path":"rules/windows/file/file_event/file_event_win_susp_colorcpl.yml","source_sha256":"306cae1a63bc4baa74420ef4933744eefe1b6a7002625938fdf8b9d664bd98d7","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_susp_colorcpl.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Creation with Colorcpl\nid: e15b518d-b4ce-4410-a9cd-501f23ce4a18\nstatus: test\ndescription: Once executed, colorcpl.exe will copy the arbitrary file to c:\\windows\\system32\\spool\\drivers\\color\\\nreferences:\n    - https://twitter.com/eral4m/status/1480468728324231172?s=20\nauthor: frack113\ndate: 2022-01-21\nmodified: 2023-01-05\ntags:\n    - attack.stealth\n    - attack.t1564\nlogsource:\n    product: windows\n    category: file_event\ndetection:\n    selection:\n        Image|endswith: '\\colorcpl.exe'\n    filter_ext:\n        TargetFilename|endswith:\n            - '.icm'\n            - '.gmmp'\n            - '.cdmp'\n            - '.camp'\n    condition: selection and not 1 of filter_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1564","id":"T1564","name":"Hide Artifacts","page":"techniques/enterprise/T1564/"}],"data_path":"data/detection-rules/e15b518d-b4ce-4410-a9cd-501f23ce4a18.json","kind":"sigma"}