T1218.002 — Control Panel

Tactic: Stealth · Platforms: Windows

Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings. Control Panel items are registered executable…

Sub-technique of System Binary Proxy Execution (T1218).

Sigma detection rules (1)

T1218.002 System Binary Proxy Execution: Control Panel

title: "T1218.002 System Binary Proxy Execution: Control Panel"
id: df95aae5-68ae-4cb9-ba47-198378b68824
description: 'Detection of Malicious Control Panel Item Execution via control.exe or Rundll32. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: CPLPathRegex, ParentProcessName, NewFileTimeWindow, RegistryKeyAllowlist.'
references:
  - https://attack.mitre.org/techniques/T1218/002
author: Shahrukh Khan
date: 2026-06-16
license: MIT
tags:
  - attack.stealth
  - attack.t1218.002

logsource:
  category: process_creation
  product: windows

detection:
  selection_control_cpl:
    EventID: '1'
    Image|endswith: '\control.exe'
    CommandLine|contains: '.cpl'
  selection_rundll32_cpl:
    EventID: '1'
    Image|endswith: '\rundll32.exe'
    CommandLine|contains:
      - '.cpl'
      - 'Control_RunDLL'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: (1 of selection_*) and not filter_system_account

falsepositives:
  - Legitimate use of Control Panel items via control.exe or rundll32.exe Shell32.dll,Control_RunDLL.

level: medium

Related sub-techniques

Explore