mirror/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2024-09-19 18:24:02 +02:00
Code Issues

Added colorcpl.exe (#315)

Browse Source 
Co-authored-by: Arjan Onwezen <arjan.onwezen@gmail.com>
This commit is contained in:
Wietze 2023-07-27 18:18:49 +01:00 committed by GitHub
parent 7241a8b7fd
commit b50df49ac2
Signed by: GitHub
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 24 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
yml/OSBinaries/Colorcpl.yml Normal file
View File

@ -0,0 +1,24 @@
---
Name: Colorcpl.exe
Description: Binary that handles color management
Author: 'Arjan Onwezen'
Created: 2023-06-26
Commands:
- Command: colorcpl file.txt
Description: Copies the referenced file to C:\Windows\System32\spool\drivers\color\.
Usecase: Copies file(s) to a subfolder of a generally trusted folder (c:\Windows\System32), which can be used to hide files or make them blend into the environment.
Category: Copy
Privileges: User
MitreID: T1036.005
OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Full_Path:
- Path: C:\Windows\System32\colorcpl.exe
- Path: C:\Windows\SysWOW64\colorcpl.exe
Detection:
- Sigma: https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_colorcpl.yml
- IOC: colorcpl.exe writing files
Resources:
- Link: https://twitter.com/eral4m/status/1480468728324231172
Acknowledgement:
- Person: eral4m
Handle: '@eral4m'