DLL Control Panel Items Registry Modification

[rule]
description = """
Identifies the modification of DLL Control Panel Items registry. Adversaries may load a malicious DLL when Control Panel
is executed via setting the CPLs subkey to the DLL path.
"""
id = "340bdcad-187f-4ccb-b84e-34ee70844d78"
license = "Elastic License v2"
name = "DLL Control Panel Items Registry Modification"
os_list = ["windows"]
reference = ["https://docs.microsoft.com/en-us/previous-versions/windows/desktop/legacy/hh127454(v=vs.85)"]
version = "1.0.26"

query = '''
registry where
 registry.path :
      ("HKEY_USERS\\S-1-5-*\\Software\\Microsoft\\Windows\\CurrentVersion\\Control Panel\\CPLs\\*",
       "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Control Panel\\CPLs\\*") and
  process.executable != null and registry.data.strings != null and not registry.data.type : "REG_DWORD" and
  not (process.executable :
              ("?:\\Windows\\System32\\svchost.exe",
               "?:\\Windows\\System32\\DriverStore\\FileRepository\\*.exe",
               "?:\\Windows\\System32\\drvinst.exe",
               "?:\\Windows\\System32\\msiexec.exe") and user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20")) and
  not (process.code_signature.subject_name : "Wacom Co., Ltd." and process.code_signature.trusted == true) and
  not registry.data.strings : ("C:\\Program Files\\*", "C:\\Program Files (x86)\\*")
'''

min_endpoint_version = "8.0.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.002"
name = "Control Panel"
reference = "https://attack.mitre.org/techniques/T1218/002/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.0.0"