T1218.002: Control Panel

Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings.

Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet function. For ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel. Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file.

Malicious Control Panel items can be delivered via Phishing campaigns or executed as part of multi-stage malware. Control Panel items, specifically CPL files, may also bypass application and/or file extension allow lists.

Adversaries may also rename malicious DLL files (.dll) with Control Panel file extensions (.cpl) and register them to HKCU\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls. Even when these registered DLLs do not comply with the CPL file specification and do not export CPlApplet functions, they are loaded and executed through its DllEntryPoint when Control Panel is executed. CPL files not exporting CPlApplet are not directly executable.

Positive Technologies products that cover the technique

MaxPatrol SIEM knowledge base

mitre_attck_defense_evasion: PT-CR-193: ControlPanel_AWL_Bypass: An attempt to bypass application-start restrictions by using control.exe (a built-in Microsoft Windows utility used to execute Control Panel items)

Detection

ID	DS0022	Data source and component	File: File Creation	Description	Monitor for newly constructed files that may forge web cookies that can be used to gain access to web applications or Internet services.

ID	DS0011	Data source and component	Module: Module Load	Description	Monitor for DLL/PE file events, such as the `Control_RunDLL` and `ControlRunDLLAsUser` API functions in shell32.dll.

ID	DS0024	Data source and component	Windows Registry: Windows Registry Key Modification	Description	Inventory Control Panel items to locate unregistered and potentially malicious files present on systems: Executable format registered Control Panel items will have a globally unique identifier (GUID) and registration Registry entries in `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace` and `HKEY_CLASSES_ROOT\CLSID{GUID}`. These entries may contain information about the Control Panel item such as its display name, path to the local file, and the command executed when opened in the Control Panel. CPL format registered Control Panel items stored in the System32 directory are automatically shown in the Control Panel. Other Control Panel items will have registration entries in the `CPLs` and `Extended Properties` Registry keys of `HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Control Panel`. These entries may include information such as a GUID, path to the local file, and a canonical name used to launch the file programmatically ( `WinExec("c:\windows\system32\control.exe {Canonical_Name}", SW_NORMAL);`) or from a command line (`control.exe /name {Canonical_Name}`). Some Control Panel items are extensible via Shell extensions registered in `HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Controls Folder{name}\Shellex\PropertySheetHandlers` where {name} is the predefined name of the system item.

ID	DS0017	Data source and component	Command: Command Execution	Description	When executed from the command line or clicked, control.exe will execute the CPL file (ex: `control.exe file.cpl`) before Rundll32 is used to call the CPL's API functions (ex: `rundll32.exe shell32.dll,Control_RunDLL file.cpl`). CPL files can be executed directly via the CPL API function with just the latter Rundll32 command, which may bypass detections and/or execution filters for control.exe.

ID	DS0009	Data source and component	Process: OS API Execution	Description	Monitor for API calls that may forge web cookies that can be used to gain access to web applications or Internet services.

ID	DS0009	Data source and component	Process: Process Creation	Description	Monitor and analyze activity related to items associated with CPL files, such as the control.exe. Analyze new Control Panel items as well as those present on disk for malicious content. Both executable and CPL formats are compliant Portable Executable (PE) images and can be examined using traditional tools and methods, pending anti-reverse-engineering techniques.

ID	Data source and component	Description
DS0022	File: File Creation	Monitor for newly constructed files that may forge web cookies that can be used to gain access to web applications or Internet services.
DS0011	Module: Module Load	Monitor for DLL/PE file events, such as the `Control_RunDLL` and `ControlRunDLLAsUser` API functions in shell32.dll.
DS0024	Windows Registry: Windows Registry Key Modification	Inventory Control Panel items to locate unregistered and potentially malicious files present on systems: Executable format registered Control Panel items will have a globally unique identifier (GUID) and registration Registry entries in `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace` and `HKEY_CLASSES_ROOT\CLSID{GUID}`. These entries may contain information about the Control Panel item such as its display name, path to the local file, and the command executed when opened in the Control Panel. CPL format registered Control Panel items stored in the System32 directory are automatically shown in the Control Panel. Other Control Panel items will have registration entries in the `CPLs` and `Extended Properties` Registry keys of `HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Control Panel`. These entries may include information such as a GUID, path to the local file, and a canonical name used to launch the file programmatically ( `WinExec("c:\windows\system32\control.exe {Canonical_Name}", SW_NORMAL);`) or from a command line (`control.exe /name {Canonical_Name}`). Some Control Panel items are extensible via Shell extensions registered in `HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Controls Folder{name}\Shellex\PropertySheetHandlers` where {name} is the predefined name of the system item.
DS0017	Command: Command Execution	When executed from the command line or clicked, control.exe will execute the CPL file (ex: `control.exe file.cpl`) before Rundll32 is used to call the CPL's API functions (ex: `rundll32.exe shell32.dll,Control_RunDLL file.cpl`). CPL files can be executed directly via the CPL API function with just the latter Rundll32 command, which may bypass detections and/or execution filters for control.exe.
DS0009	Process: OS API Execution	Monitor for API calls that may forge web cookies that can be used to gain access to web applications or Internet services.
DS0009	Process: Process Creation	Monitor and analyze activity related to items associated with CPL files, such as the control.exe. Analyze new Control Panel items as well as those present on disk for malicious content. Both executable and CPL formats are compliant Portable Executable (PE) images and can be examined using traditional tools and methods, pending anti-reverse-engineering techniques.

Mitigation

ID	M1022	Name	Restrict File and Directory Permissions	Description	Restrict storage and execution of Control Panel items to protected directories, such as `C:\Windows`, rather than user directories.

ID	M1038	Name	Execution Prevention	Description	Identify and block potentially malicious and unknown .cpl files by using application control tools, like Windows Defender Application Control, AppLocker, or Software Restriction Policies where appropriate.

ID	Name	Description
M1022	Restrict File and Directory Permissions	Restrict storage and execution of Control Panel items to protected directories, such as `C:\Windows`, rather than user directories.
M1038	Execution Prevention	Identify and block potentially malicious and unknown .cpl files by using application control tools, like Windows Defender Application Control, AppLocker, or Software Restriction Policies where appropriate.