Detection rules › Splunk
Control Panel Abuse (Windows Event Log)
Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings. Adversaries may also rename malicious DLL files (.dll) with Control Panel file extensions (.cpl), Control Panel items, specifically CPL files, may also bypass application and/or file extension allow lists
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | T1218.002 System Binary Proxy Execution: Control Panel |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4688 | A new process has been created. |
Rule body yaml
id: '5992.6362'
title: Control Panel Abuse
description: 'Adversaries may abuse control.exe to proxy execution of malicious payloads.
The Windows Control Panel process binary (control.exe) handles execution of Control
Panel items, which are utilities that allow users to view and adjust computer settings.
Adversaries may also rename malicious DLL files (.dll) with Control Panel file extensions
(.cpl), Control Panel items, specifically CPL files, may also bypass application
and/or file extension allow lists. - Threat Actor Association: Alloy Taurus/Gallium,
Lazarus, UNC2589 - Atomics T1218.002 Test#1 - #TrendingThreat #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
"<EventID>4688<" OR Type=Process) "control.exe" ("cpl" OR "dll" OR "inf" OR "\.\.\/")
| regex process="(?i)(control\.exe.+?\.(dll|cpl|\.\/|inf))" | table _time, host,
user parent_*, process, process_*, signature_id | bin span=1s | stats values(*)
as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:control panel
technique_id:
- T1218.002
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://lolbas-project.github.io/lolbas/Binaries/Control/
- https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process) "control.exe" ("cpl" OR "dll" OR "inf" OR "\.\.\/")
Stage 2: regex
| regex process="(?i)(control\.exe.+?\.(dll|cpl|\.\/|inf))"
Stage 3: table
| table _time, host, user parent_*, process, process_*, signature_id
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4688<" |
| 1 | "control.exe" |
| 1 | "cpl" |
| 1 | "dll" |
| 1 | "inf" |
| 1 | "\.\.\/" |