mirror of
https://github.com/LOLBAS-Project/LOLBAS
synced 2024-12-30 16:54:00 +01:00
25 lines
969 B
YAML
25 lines
969 B
YAML
|
---
|
||
|
|
Name: Colorcpl.exe
|
||
|
|
Description: Binary that handles color management
|
||
|
|
Author: 'Arjan Onwezen'
|
||
|
|
Created: 2023-06-26
|
||
|
|
Commands:
|
||
|
|
- Command: colorcpl file.txt
|
||
|
|
Description: Copies the referenced file to C:\Windows\System32\spool\drivers\color\.
|
||
|
|
Usecase: Copies file(s) to a subfolder of a generally trusted folder (c:\Windows\System32), which can be used to hide files or make them blend into the environment.
|
||
|
|
Category: Copy
|
||
|
|
Privileges: User
|
||
|
|
MitreID: T1036.005
|
||
|
|
OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
|
||
|
|
Full_Path:
|
||
|
|
- Path: C:\Windows\System32\colorcpl.exe
|
||
|
|
- Path: C:\Windows\SysWOW64\colorcpl.exe
|
||
|
|
Detection:
|
||
|
|
- Sigma: https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_colorcpl.yml
|
||
|
|
- IOC: colorcpl.exe writing files
|
||
|
|
Resources:
|
||
|
|
- Link: https://twitter.com/eral4m/status/1480468728324231172
|
||
|
|
Acknowledgement:
|
||
|
|
- Person: eral4m
|
||
|
|
Handle: '@eral4m'
|