Suspicious Creation with Colorcpl — Detection Rule
Once executed, colorcpl.exe will copy the arbitrary file to c:\windows\system32\spool\drivers\color\
Once executed, colorcpl.exe will copy the arbitrary file to c:\windows\system32\spool\drivers\color\