---
Name: Colorcpl.exe
Description: Binary that handles color management
Author: 'Arjan Onwezen'
Created: 2023-06-26
Commands:
  - Command: colorcpl file.txt
    Description: Copies the referenced file to C:\Windows\System32\spool\drivers\color\.
    Usecase: Copies file(s) to a subfolder of a generally trusted folder (c:\Windows\System32), which can be used to hide files or make them blend into the environment.
    Category: Copy
    Privileges: User
    MitreID: T1036.005
    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Full_Path:
  - Path: C:\Windows\System32\colorcpl.exe
  - Path: C:\Windows\SysWOW64\colorcpl.exe
Detection:
  - Sigma: https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_colorcpl.yml
  - IOC: colorcpl.exe writing files
Resources:
  - Link: https://twitter.com/eral4m/status/1480468728324231172
Acknowledgement:
  - Person: eral4m
    Handle: '@eral4m'