Cross-source coverage
T1218.002 / ATT&CK
System Binary Proxy Execution: Control Panel
From MITRE ATT&CK 19.2
Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings.
Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet function. For ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel. Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file.
Malicious Control Panel items can be delivered via Phishing campaigns or executed as part of multi-stage malware. Control Panel items, specifically CPL files, may also bypass application and/or file extension allow lists.
Adversaries may also rename malicious DLL files (.dll) with Control Panel file extensions (.cpl) and register them to HKCU\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls. Even when these registered DLLs do not comply with the CPL file specification and do not export CPlApplet functions, they are loaded and executed through its DllEntryPoint when Control Panel is executed. CPL files not exporting CPlApplet are not directly executable.
- Tactics
- Stealth
- Platforms
- Windows
- Telemetry
-
WinEventLog:Sysmon
How MITRE says to detect it DET0194
Detection of Malicious Control Panel Item Execution via control.exe or Rundll32
Windows Analytic 0558
Execution of control.exe or rundll32.exe with parameters pointing to CPL files, especially from non-standard directories or newly created files, followed by suspicious child process execution or registry modifications registering new Control Panel items.
WinEventLog:SysmonEventCode=1WinEventLog:SysmonEventCode=11WinEventLog:SysmonEventCode=7WinEventLog:SysmonEventCode=12
elastic/protections-artifacts
4 rules| Detection | Severity | Format |
|---|---|---|
| Control Panel Process with Unusual Arguments | Undefined | Elastic TOML |
| DLL Control Panel Items Registry Modification | Undefined | Elastic TOML |
| Suspicious Activity from a Control Panel Applet | Undefined | Elastic TOML |
| Suspicious Control Panel DLL Loaded by Explorer | Undefined | Elastic TOML |
elastic/detection-rules
3 rules| Detection | Severity | Format |
|---|---|---|
| Control Panel Process with Unusual Arguments | High | Elastic TOML |
| Suspicious MS Office Child Process | Medium | Elastic TOML |
| Unusual Network Activity from a Windows System Binary | Medium | Elastic TOML |
SigmaHQ/sigma
1 rule| Detection | Severity | Format |
|---|---|---|
| Control Panel Items | High | Sigma |
splunk/security_content
1 rule| Detection | Severity | Format |
|---|---|---|
| Control Loading from World Writable Directory | Undefined | SPL |