Detection rules › Splunk
Control Panel Abuse (Sysmon)
Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings. Adversaries may also rename malicious DLL files (.dll) with Control Panel file extensions (.cpl), Control Panel items, specifically CPL files, may also bypass application and/or file extension allow lists
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth |
References
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule body
id: '5992.18210'
title: Control Panel Abuse
description: 'Adversaries may abuse control.exe to proxy execution of malicious payloads.
The Windows Control Panel process binary (control.exe) handles execution of Control
Panel items, which are utilities that allow users to view and adjust computer settings.
Adversaries may also rename malicious DLL files (.dll) with Control Panel file extensions
(.cpl), Control Panel items, specifically CPL files, may also bypass application
and/or file extension allow lists. - Threat Actor Association: Alloy Taurus/Gallium,
Lazarus, UNC2589 - Atomics T1218.002 Test#1 - #TrendingThreat #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` ("EventCode=1" OR "<EventID>1<")
"control.exe" ("cpl" OR "dll" OR "inf" OR "\.\.\/") | regex process="(?i)(control\.exe.+?\.(dll|cpl|\.\/|inf))"
| table _time, host, user parent_*, process, process_*, signature_id | bin span=1s
| stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:control panel
technique_id:
- T1218.002
data_category:
- Windows Sysmon
references:
- https://lolbas-project.github.io/lolbas/Binaries/Control/
- https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` ("EventCode=1" OR "<EventID>1<") "control.exe" ("cpl" OR "dll" OR "inf" OR "\.\.\/")
Stage 2: regex
| regex process="(?i)(control\.exe.+?\.(dll|cpl|\.\/|inf))"
Stage 3: table
| table _time, host, user parent_*, process, process_*, signature_id
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
process | regex_match |
| field:"CommandLine" kind:regex_match |
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | "EventCode=1" |
| 1 | "<EventID>1<" |
| 1 | "control.exe" |
| 1 | "cpl" |
| 1 | "dll" |
| 1 | "inf" |
| 1 | "\.\.\/" |