The Windows Control Panel process binary, control.exe, handles Control Panel items. MITRE ATT&CK tracks the abuse of it as T1218.002, Control Panel, a System Binary Proxy Execution sub-technique in the Stealth tactic, on Windows.
How attackers use it
Control Panel items are registered executable files or Control Panel (.cpl) files. A .cpl file is a renamed DLL that exports a function called CPlApplet. Items can run from the command line, through an API call, or by double clicking the file.
MITRE says malicious items can be delivered through Phishing or run as part of multi stage malware, and CPL files may bypass application and file extension allow lists.
There is one more detail worth knowing. Adversaries may rename malicious DLLs with a .cpl extension and register them under the HKCU Control Panel Cpls registry key. Even DLLs that do not follow the CPL format are loaded and run through their DllEntryPoint when Control Panel runs.
How to detect it
MITRE's strategy looks for control.exe or rundll32.exe launched with parameters pointing to CPL files, especially from non-standard directories or newly created files. The follow up signals are suspicious child processes and registry modifications that register new Control Panel items.
So collect two things. Process creation with command lines covers the launch. Registry write telemetry (Sysmon event ID 13) on the Cpls key covers the registration path, and that key is under a user hive, so any user process can write to it.
How to reduce the risk
- Restrict the storage and execution of Control Panel items to protected directories such as C:\Windows rather than user directories.
- Identify and block unknown or malicious .cpl files with application control, such as Windows Defender Application Control, AppLocker or Software Restriction Policies.
Check your own environment
This read-only command lists any registered per user Control Panel items on Windows (cmd.exe):
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls"
On most machines the key is empty or absent. Anything listed there should be explained. Also check whether your mail gateway lets .cpl attachments through.
Where to start
Look at the Cpls registry key on a sample of machines and note anything registered under a user hive. Then check where .cpl files are allowed to run from. If your policy already limits execution to protected directories such as C:\Windows, you have most of the benefit MITRE describes. If it does not, an application control rule for .cpl files outside protected paths is a small change with a clear payoff, and a mail gateway rule for .cpl attachments closes the delivery route.
Quick check
Why is the Cpls registry key a hunting target?
Adversaries can register renamed DLLs there, and they will be loaded when Control Panel runs. A new entry that nobody recognizes is a lead.
Sources
- MITRE ATT&CK, T1218.002: https://attack.mitre.org/techniques/T1218/002
