Detection rules › Kusto
PE file dropped in Color Profile Folder
This query looks for writes of PE files to C:\Windows\System32\spool\drivers\color. This is a common directory used by malware, as well as some legitimate programs, and writes of PE files to the folder should be monitored. Ref: https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1203 Exploitation for Client Execution |
Event coverage
| Provider | Event/ActionType | Title |
|---|---|---|
| Sysmon | Event ID 11 | FileCreate |
| Security-Auditing | Event ID 4663 | An attempt was made to access an object. |
| Defender-DeviceFileEvents | FileCreated | File created |
Rule body kusto
id: f68a5046-b7eb-4f69-9519-1e99708bb9e0
name: PE file dropped in Color Profile Folder
description: |
'This query looks for writes of PE files to C:\Windows\System32\spool\drivers\color\.
This is a common directory used by malware, as well as some legitimate programs, and writes of PE files to the folder should be monitored.
Ref: https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/'
severity: Medium
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
dataTypes:
- DeviceFileEvents
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
- Execution
relevantTechniques:
- T1203
tags:
- KNOTWEED
query: |
DeviceFileEvents
| where ActionType =~ "FileCreated"
| where FolderPath has "C:\\Windows\\System32\\spool\\drivers\\color\\"
| where FileName endswith ".exe" or FileName endswith ".dll"
entityMappings:
- entityType: File
fieldMappings:
- identifier: Name
columnName: FileName
- entityType: Host
fieldMappings:
- identifier: HostName
columnName: DeviceName
version: 1.0.1
kind: Scheduled
metadata:
source:
kind: Community
author:
name: Pete Bryan
support:
tier: Community
categories:
domains: [ "Security - Others" ]
Stages and Predicates
Stage 1: source
DeviceFileEvents
Stage 2: where
| where ActionType =~ "FileCreated"
Stage 3: where
| where FolderPath has "C:\\Windows\\System32\\spool\\drivers\\color\\"
Stage 4: where
| where FileName endswith ".exe" or FileName endswith ".dll"
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
ActionType | eq |
|
FileName | ends_with |
|
FolderPath | match |
|