TTF Trap - Suspended colorcpl.exe Injection Host via LuaJIT-FFI or AutoIt
Detects colorcpl.exe being spawned as a suspended injection host by an interpreter dropped to C:\Users\Public\Libraries as part of the TTF Trap campaign, regardless of whether the triggering parent is luajit.exe or AutoIt3.exe. The campaign implements two functionally equivalent injection chains into colorcpl.exe - a LuaJIT-FFI path that resolves kernel32 APIs via FFI/bit libraries and a parallel AutoIt-driven ntdll-unhooking path - both of which launch colorcpl.exe suspended, then perform VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread to reconstruct and execute Donut-packed shellcode in its address space. Matching on the Public\Libraries staging path (rather than solely on interpreter name) ensures the rule fires on either trigger path even if the interpreter binary is renamed.
Sigma
