Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings.
Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet function.[1][2] For ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel.[1] Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file.[1] [2][3]
Malicious Control Panel items can be delivered via Phishing campaigns[2][3] or executed as part of multi-stage malware.[4] Control Panel items, specifically CPL files, may also bypass application and/or file extension allow lists.
Adversaries may also rename malicious DLL files (.dll) with Control Panel file extensions (.cpl) and register them to HKCU\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls. Even when these registered DLLs do not comply with the CPL file specification and do not export CPlApplet functions, they are loaded and executed through its DllEntryPoint when Control Panel is executed. CPL files not exporting CPlApplet are not directly executable.[5]
| ID | Name | Description |
|---|---|---|
| S0260 | InvisiMole |
InvisiMole can register itself for execution and persistence via the Control Panel.[5] |
| S0172 | Reaver |
Reaver drops and executes a malicious CPL file as its payload.[4] |
| ID | Mitigation | Description |
|---|---|---|
| M1038 | Execution Prevention |
Identify and block potentially malicious and unknown .cpl files by using application control [6] tools, like Windows Defender Application Control[7], AppLocker, [8] [9] or Software Restriction Policies [10] where appropriate. [11] |
| M1022 | Restrict File and Directory Permissions |
Restrict storage and execution of Control Panel items to protected directories, such as |
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0017 | Command | Command Execution |
When executed from the command line or clicked, control.exe will execute the CPL file (ex: |
| DS0022 | File | File Creation |
Monitor for newly constructed files that may forge web cookies that can be used to gain access to web applications or Internet services. |
| DS0011 | Module | Module Load |
Monitor for DLL/PE file events, such as the |
| DS0009 | Process | OS API Execution |
Monitor for API calls that may forge web cookies that can be used to gain access to web applications or Internet services. |
| Process Creation |
Monitor and analyze activity related to items associated with CPL files, such as the control.exe. Analyze new Control Panel items as well as those present on disk for malicious content. Both executable and CPL formats are compliant Portable Executable (PE) images and can be examined using traditional tools and methods, pending anti-reverse-engineering techniques.[2] |
||
| DS0024 | Windows Registry | Windows Registry Key Modification |
Inventory Control Panel items to locate unregistered and potentially malicious files present on systems:* Executable format registered Control Panel items will have a globally unique identifier (GUID) and registration Registry entries in |