Suspicious Configdat Creation In Printer Color Directory
This rule detects the creation of a file named 'config.dat' within the Windows printer color profile directory (typically 'C:\Windows\System32\spool\drivers\color'). This activity is suspicious because 'config.dat' in this specific location is often targeted by malware, such as the SprySocks backdoor, to maintain persistence or store malicious configurations. Legitimate modifications to this file are rare and usually associated with printer driver installations or manual color profile adjustments, which should be investigated as potential false positives.
YARA-L
