detection.wiki

Detection rules › Sigma

Control Panel Items

Status
test
Severity
high
Log source
product windows, category process_creation
Author
Kyaw Min Thein, Furkan Caliskan (@caliskanfurkan_)
Source
github.com/SigmaHQ/sigma

Detects the malicious use of a control panel item

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1546 Event Triggered Execution
Privilege EscalationT1546 Event Triggered Execution
StealthT1218.002 System Binary Proxy Execution: Control Panel

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: Control Panel Items
id: 0ba863e6-def5-4e50-9cea-4dd8c7dc46a4
status: test
description: Detects the malicious use of a control panel item
references:
    - https://ired.team/offensive-security/code-execution/code-execution-through-control-panel-add-ins
author: Kyaw Min Thein, Furkan Caliskan (@caliskanfurkan_)
date: 2020-06-22
modified: 2023-10-11
tags:
    - attack.privilege-escalation
    - attack.execution
    - attack.stealth
    - attack.t1218.002
    - attack.persistence
    - attack.t1546
logsource:
    product: windows
    category: process_creation
detection:
    selection_reg_img:
        - Image|endswith: '\reg.exe'
        - OriginalFileName: 'reg.exe'
    selection_reg_cli:
        CommandLine|contains|all:
            - 'add'
            - 'CurrentVersion\Control Panel\CPLs'
    selection_cpl:
        CommandLine|endswith: '.cpl'
    filter_cpl_sys:
        CommandLine|contains:
            - '\System32\'
            - '%System%'
            - '|C:\Windows\system32|'
    filter_cpl_igfx:
        CommandLine|contains|all:
            - 'regsvr32 '
            - ' /s '
            - 'igfxCPL.cpl'
    condition: all of selection_reg_* or (selection_cpl and not 1 of filter_cpl_*)
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

all of selection_reg_* or (selection_cpl and not 1 of filter_cpl_*)

Stage 1: selection_reg_img

selection_reg_img:
    - Image|endswith: '\reg.exe'
    - OriginalFileName: 'reg.exe'

Stage 2: selection_reg_cli

selection_reg_cli:
    CommandLine|contains|all:
        - 'add'
        - 'CurrentVersion\Control Panel\CPLs'

Stage 3: selection_cpl

selection_cpl:
    CommandLine|endswith: '.cpl'

Stage 4: not filter_cpl_*

filter_cpl_sys:
    CommandLine|contains:
        - '\System32\'
        - '%System%'
        - '|C:\Windows\system32|'
filter_cpl_igfx:
    CommandLine|contains|all:
        - 'regsvr32 '
        - ' /s '
        - 'igfxCPL.cpl'

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
CommandLinematch /s
CommandLinematchigfxCPL.cpl
CommandLinematchregsvr32
CommandLinematch%System%
CommandLinematch\System32\
CommandLinematch|C:\Windows\system32|

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLineends_with
  • .cpl
CommandLinematch
  • CurrentVersion\Control Panel\CPLs
  • add corpus 34 (sigma 26, splunk 4, chronicle 2, kusto 2)
Imageends_with
  • \reg.exe corpus 58 (sigma 58)
OriginalFileNameeq
  • reg.exe corpus 42 (sigma 32, splunk 8, elastic 2)