PE file dropped in Color Profile Folder

Severity: medium
Time window: 1d
Author: Pete Bryan
Source: github.com/Azure/Azure-Sentinel

This query looks for writes of PE files to C:\Windows\System32\spool\drivers\color. This is a common directory used by malware, as well as some legitimate programs, and writes of PE files to the folder should be monitored. Ref: https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1203` Exploitation for Client Execution

Telemetry coverage

Platform	Record / event type
Microsoft Defender for Endpoint	`DeviceFileEvents` action `FileCreated`: File created
Microsoft Defender for Endpoint	`DeviceFileEvents` action `any`: File activity

Rule body

id: f68a5046-b7eb-4f69-9519-1e99708bb9e0
name:  PE file dropped in Color Profile Folder
description: |
  'This query looks for writes of PE files to C:\Windows\System32\spool\drivers\color\.
    This is a common directory used by malware, as well as some legitimate programs, and writes of PE files to the folder should be monitored.
    Ref: https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/'
severity: Medium
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - DeviceFileEvents
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Execution
relevantTechniques:
  - T1203
tags:
  - KNOTWEED
query: |
  DeviceFileEvents
    | where ActionType =~ "FileCreated"
    | where FolderPath has "C:\\Windows\\System32\\spool\\drivers\\color\\" 
    | where FileName endswith ".exe" or FileName endswith ".dll"
entityMappings:
  - entityType: File
    fieldMappings:
      - identifier: Name
        columnName: FileName
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: DeviceName
version: 1.0.1
kind: Scheduled
metadata:
    source:
        kind: Community
    author:
        name: Pete Bryan
    support:
        tier: Community
    categories:
        domains: [ "Security - Others" ]

Stages and Predicates

Stage 1: `source`

DeviceFileEvents

Stage 2: `where`

| where ActionType =~ "FileCreated"

Stage 3: `where`

| where FolderPath has "C:\\Windows\\System32\\spool\\drivers\\color\\"

Stage 4: `where`

| where FileName endswith ".exe" or FileName endswith ".dll"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ActionType`	eq	`FileCreated`	`field:"ActionType" kind:eq value:"FileCreated"`
`FileName`	ends_with	`.dll` corpus 7 (splunk 6, kusto 1) `.exe` corpus 2 (kusto 2)	`field:"file_name" kind:ends_with`
`FolderPath`	match	`C:\Windows\System32\spool\drivers\color\` transforms: `term`	`field:"TargetFilename" kind:match value:"C:\Windows\System32\spool\drivers\color\"`