Suspicious File Creation by Colorcpl.exe
This rule detects suspicious file creation activity involving 'colorcpl.exe'. Specifically, it looks for instances where 'colorcpl.exe' is the image creating files in the 'c:\windows\system32\spool\drivers\color\' directory, excluding common color profile file extensions like '.icm', '.gmmp', '.cdmp', and '.camp'. This behavior is indicative of an adversary attempting to hide malicious files within a legitimate system directory by abusing the color management control panel utility.
Sigma
