Control Panel

T1218.002

Sub-technique of T1218 System Binary Proxy Execution.View on attack.mitre.org

About this technique

Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings.

Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet function. For ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel. Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file.

Malicious Control Panel items can be delivered via Phishing campaigns or executed as part of multi-stage malware. Control Panel items, specifically CPL files, may also bypass application and/or file extension allow lists.

Adversaries may also rename malicious DLL files (.dll) with Control Panel file extensions (.cpl) and register them to HKCU\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls. Even when these registered DLLs do not comply with the CPL file specification and do not export CPlApplet functions, they are loaded and executed through its DllEntryPoint when Control Panel is executed. CPL files not exporting CPlApplet are not directly executable.

Detection rules2

Rules on DetectionCode tagged with T1218.002.

Sigma1

Rule	Level	Log source
Control Panel Items	high	windows / process_creation

Splunk1

Rule	Type	Risk	Data source
Control Loading from World Writable Directory	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2

Groups0

None recorded.

Software2

InvisiMole Reaver

Campaigns0

None recorded.

Procedure examples2

Software2

Used by	Procedure example
MalwareInvisiMole	InvisiMole can register itself for execution and persistence via the Control Panel. ESET InvisiMole June 2020
MalwareReaver	Reaver drops and executes a malicious CPL file as its payload. Palo Alto Reaver Nov 2017

References5

ESET InvisiMole June 2020 Open source
Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.
Microsoft Implementing CPL Open source
M. (n.d.). Implementing Control Panel Items. Retrieved January 18, 2018.
Palo Alto Reaver Nov 2017 Open source
Grunzweig, J. and Miller-Osborn, J. (2017, November 10). New Malware with Ties to SunOrcal Discovered. Retrieved November 16, 2017.
TrendMicro CPL Malware Dec 2013 Open source
Bernardino, J. (2013, December 17). Control Panel Files Used As Malicious Attachments. Retrieved January 18, 2018.
TrendMicro CPL Malware Jan 2014 Open source
Mercês, F. (2014, January 27). CPL Malware - Malicious Control Panel Items. Retrieved January 18, 2018.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.