WDAC

Windows Defender Application Control -- Previously known as AppLocker

The following directory is typically has global read write permissions and is under windows\system32 which is frequently whitelisted by AppLocker. This makes it an ideal place to work out of.

C:\Windows\system32\spool\drivers\color\