KNOTWEED-PE File Dropped in Color Profile Folder

Description

'This query identifies modifications to COM registry keys to point to executable files in C:\Windows\System32\spool\drivers\color\'

Query · kql

// PE file dropped in C:\Windows\System32\spool\drivers\color\
DeviceFileEvents
| where Timestamp > ago(7d)
| where ActionType == "FileCreated"
| where FolderPath has "C:\\Windows\\System32\\spool\\drivers\\color\\"
| where FileName endswith ".exe" or FileName endswith ".dll"
Raw source KNOTWEED-PE File Dropped in Color Profile Folder · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: cfdb2ccb-0eb3-47ed-9220-d56795906fdc
name: KNOTWEED-PE File Dropped in Color Profile Folder
description: |
  'This query identifies modifications to COM registry keys to point to executable files in C:\Windows\System32\spool\drivers\color\'
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - DeviceFileEvents
tactics:
relevantTechniques:
query: |
  // PE file dropped in C:\Windows\System32\spool\drivers\color\
  DeviceFileEvents
  | where Timestamp > ago(7d)
  | where ActionType == "FileCreated"
  | where FolderPath has "C:\\Windows\\System32\\spool\\drivers\\color\\"
  | where FileName endswith ".exe" or FileName endswith ".dll"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.