MITRE ATT&CKsub-technique

T1218.002 Control Panel

Published 2020-01-23 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Stealth
Platforms
Windows
Version
3.0
Created
2020-01-23

Description

Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings. Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet function. For ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel. Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file. Malicious Control Panel items can be delivered via Phishing campaigns or executed as part of multi-stage malware. Control Panel items, specifically CPL files, may also bypass application and/or file extension allow lists. Adversaries may also rename malicious DLL files (.dll) with Control Panel file extensions (.cpl) and register them to HKCU\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls. Even when these registered DLLs do not comply with the CPL file specification and do not export CPlApplet functions, they are loaded and executed through its DllEntryPoint when Control Panel is executed. CPL files not exporting CPlApplet are not directly executable.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1218 System Binary Proxy Execution technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (2)

  • M1038 Execution Prevention mitigation
  • M1022 Restrict File and Directory Permissions mitigation

Referenced by MITRE ATT&CK · uses (2)

  • S0260 InvisiMole software (malware)
  • S0172 Reaver software (malware)

Referenced by Compliance · mitigates (11)

  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-11 User-installed Software NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-SI-10 Information Input Validation NIST 800-53 control
  • NIST-SI-16 Memory Protection NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References