Drop Binaries Into Spool Drivers Color Folder
Detects the creation of suspicious binary files (DLL, EXE, SYS) within the `C:\Windows\System32\spool\drivers\color\` directory. This activity has been observed in attacks by threat actors, such as those described in the referenced Microsoft blog, where it's used for defense evasion or persistence by dropping malicious payloads in a trusted system directory.
Sigma
