diff --git a/yml/OSBinaries/Colorcpl.yml b/yml/OSBinaries/Colorcpl.yml
new file mode 100644
index 0000000..e894bba
--- /dev/null
+++ b/yml/OSBinaries/Colorcpl.yml
@@ -0,0 +1,24 @@
+---
+Name: Colorcpl.exe
+Description: Binary that handles color management
+Author: 'Arjan Onwezen'
+Created: 2023-06-26
+Commands:
+  - Command: colorcpl file.txt
+    Description: Copies the referenced file to C:\Windows\System32\spool\drivers\color\.
+    Usecase: Copies file(s) to a subfolder of a generally trusted folder (c:\Windows\System32), which can be used to hide files or make them blend into the environment.
+    Category: Copy
+    Privileges: User
+    MitreID: T1036.005
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
+Full_Path:
+  - Path: C:\Windows\System32\colorcpl.exe
+  - Path: C:\Windows\SysWOW64\colorcpl.exe
+Detection:
+  - Sigma: https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_colorcpl.yml
+  - IOC: colorcpl.exe writing files
+Resources:
+  - Link: https://twitter.com/eral4m/status/1480468728324231172
+Acknowledgement:
+  - Person: eral4m
+    Handle: '@eral4m'