T1218.002sub-technique of T1218 System Binary Proxy Execution
Control Panel
Windowsnothing on this site yetT1218.002 on attack.mitre.org
Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings. Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a `CPlApplet` function.
how MITRE says to see it
Detection of Malicious Control Panel Item Execution via control.exe or Rundll32
- Execution of control.exe or rundll32.exe with parameters pointing to CPL files, especially from non-standard directories or newly created files, followed by suspicious child process execution or registry modifications registering new Control Panel items.
what reduces it
- M1038 Execution Prevention. Identify and block potentially malicious and unknown.cpl files by using application control tools, like Windows Defender Application Control, AppLocker, or Software Restriction Policies where appropriate.
- M1022 Restrict File and Directory Permissions. Restrict storage and execution of Control Panel items to protected directories, such as `C:\Windows`, rather than user directories.