InvisiMoleS0260 ↗
Can register itself for execution and persistence via the Control Panel.1
tfMITRE ATT&CK sub-technique
Control Panel T1218.002
sub-technique of T1218 System Binary Proxy Execution
- Tactic
- Stealth
- Platform
- Windows
- Version
- 3.0
- Created
- 23 January 2020
- Last modified
- 12 May 2026
- Contributor
- ESET
Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.2
Tools & malware51st pct
Tools & malware51st percentile · 51% of ATT&CK techniques have this many tools implementing them or fewer.2
Detection rules50th pct
Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.Control Panel MITRE reference T1218.002
51st pctamong all ATT&CK techniques for number of tools
Offense vs defense T1218.002
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 1
first rule: 2020 Q2Control Panel detection strategy DET0194
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Malicious Control Panel Item Execution via control.exe or Rundll32
1 platform
AN0558 · Windows
Execution of control.exe or rundll32.exe with parameters pointing to CPL files, especially from non-standard directories or newly created files, followed by suspicious child process execution or registry modifications registering new Control Panel items.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Module LoadDC0016 | WinEventLog:Sysmon | EventCode=7 |
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| Windows Registry Key CreationDC0056 | WinEventLog:Sysmon | EventCode=12 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| CPLPathRegex | Regex to match CPL file paths; tune to exclude legitimate CPLs in System32 |
| ParentProcessName | Helps filter known parent processes that legitimately use control.exe |
| NewFileTimeWindow | Time delta between CPL file creation and execution to detect rapid execution of newly dropped files |
| RegistryKeyAllowlist | Whitelist of known good CPL registry entries |
Execution PreventionM1038
Identify and block potentially malicious and unknown .cpl files by using application control tools, like Windows Defender Application Control, AppLocker, or Software Restriction Policies where appropriate.
Restrict storage and execution of Control Panel items to protected directories, such as C:\Windows, rather than user directories.
Tests1Executorscmd 1Need elevation0 of 1Have prerequisites1Have cleanup0Platformswindows
Tests from Atomic Red Team (MIT licence) · technique definition