Control panel item executed from a user-writable directory

Siemphony@siemphonymediumT1218.002verified in lab

Matches the first arm of AN0558: control.exe or rundll32.exe created with a command line that names a .cpl file living under a directory an unprivileged user can write to. A .cpl is a renamed DLL exporting `CPlApplet`, so both binaries load and run it in their own process — that load is the proxy execution this technique is about, and a payload delivered by phishing lands in Downloads, %TEMP% or %AppData% rather than in System32. The path clause is MITRE's `CPLPathRegex` knob, whose description says to tune it to exclude the legitimate applets in System32; the directory list below is authored here, not supplied by MITRE. The consequence is stated plainly: an applet staged into System32 by an adversary who already has write access there, one launched from a UNC share, and one loaded through the `CPlApplet` API rather than from a command line all fall outside this rule. So does a payload renamed away from the .cpl extension: shell32's `Control_RunDLL` loads whatever DLL it is handed regardless of what the file is called, so `rundll32.exe shell32.dll,Control_RunDLL invoice.dat` proxies the same applet past the `.cpl` clause. Both `contains` clauses are independent, so nothing requires the .cpl string and the writable path to belong to the same token on the command line. AN0558's other three log sources are not attempted. Its file_event (Sysmon EventID 11) and image_load (EventID 7) arms only mean anything joined to the execution through the `NewFileTimeWindow` knob, and Sigma models neither a timeframe nor a join; its registry_add (EventID 12) arm for newly registered Control Panel items turns on `RegistryKeyAllowlist`, a list of known-good entries the brief supplies no values for. This rule is written in the Sysmon EventID 1 vocabulary (`Image`, `CommandLine`) that AN0558 names. An estate feeding Security 4688 instead needs `NewProcessName` mapped onto `Image` first, and 4688 needs both *Audit Process Creation* and the separate *Include command line in process creation events* policy before `CommandLine` exists at all — neither is on in a default install or in the Microsoft and CIS baselines. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0194, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (((FolderPath endswith "\\control.exe" or FolderPath endswith "\\rundll32.exe") and ProcessCommandLine contains ".cpl") and (ProcessCommandLine contains "\\AppData\\" or ProcessCommandLine contains "\\Temp\\" or ProcessCommandLine contains "\\Users\\Public\\" or ProcessCommandLine contains "\\Downloads\\" or ProcessCommandLine contains "\\ProgramData\\" or ProcessCommandLine contains "\\Windows\\Tasks\\" or ProcessCommandLine contains "\\PerfLogs\\"))

Splunk · SPL

Run this as a search.

index=* (((Image="*\\control.exe" OR Image="*\\rundll32.exe") AND CommandLine="*.cpl*") AND (CommandLine="*\\AppData\\*" OR CommandLine="*\\Temp\\*" OR CommandLine="*\\Users\\Public\\*" OR CommandLine="*\\Downloads\\*" OR CommandLine="*\\ProgramData\\*" OR CommandLine="*\\Windows\\Tasks\\*" OR CommandLine="*\\PerfLogs\\*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(process.executable) LIKE "*\\\\control.exe" OR TO_LOWER(process.executable) LIKE "*\\\\rundll32.exe") AND TO_LOWER(process.command_line) LIKE "*.cpl*") AND (TO_LOWER(process.command_line) LIKE "*\\\\appdata\\\\*" OR TO_LOWER(process.command_line) LIKE "*\\\\temp\\\\*" OR TO_LOWER(process.command_line) LIKE "*\\\\users\\\\public\\\\*" OR TO_LOWER(process.command_line) LIKE "*\\\\downloads\\\\*" OR TO_LOWER(process.command_line) LIKE "*\\\\programdata\\\\*" OR TO_LOWER(process.command_line) LIKE "*\\\\windows\\\\tasks\\\\*" OR TO_LOWER(process.command_line) LIKE "*\\\\perflogs\\\\*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\control\.exe$|\\rundll32\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)\.cpl</field>    <field name="CommandLine" type="pcre2">(?i)(\\AppData\\|\\Temp\\|\\Users\\Public\\|\\Downloads\\|\\ProgramData\\|\\Windows\\Tasks\\|\\PerfLogs\\)</field>    <description>Control panel item executed from a user-writable directory</description>    <mitre>      <id>T1218.002</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: signed_binary_proxy
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 89981383-b1b5-4163-87d7-1ab30b051bcb

ATT&CKT1218.002

T1218.002Control Panel

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonsigned binary proxy

signed binary proxyAI draft — unreviewed

01 · What this rule detects

A process creation where control.exe or rundll32.exe starts with a command line that names a .cpl file and also names a directory an unprivileged user can write to. A .cpl is a renamed DLL exporting CPlApplet; both binaries load it into their own process, and that load is the proxy execution this technique is about. A phished applet lands in Downloads, %TEMP% or %AppData% rather than in System32, which is the whole basis of the discrimination.

02 · Telemetry you need

Sysmon EventID 1 process creation — logsource category: process_creation, product: windows, copied verbatim from AN0558 — and the rule is written in that vocabulary (Image, CommandLine). An estate feeding Security 4688 instead must map NewProcessName onto Image first, and 4688 needs both Audit Process Creation and the separate Include command line in process creation events policy before CommandLine exists at all. Neither is on in a default install or in the Microsoft and CIS baselines, so a 4688 estate without them gets zero rows that read as quiet when they mean blind.

03 · How the logic works

Three selections ANDed together. selection_proxy_binary is Image|endswith on \control.exe and \rundll32.exe. selection_cpl is CommandLine|contains: '.cpl'. selection_writable_path is CommandLine|contains across \AppData\, \Temp\, \Users\Public\, \Downloads\, \ProgramData\, \Windows\Tasks\ and \PerfLogs\. That path list is MITRE's CPLPathRegex knob — MITRE says to tune it to exclude the legitimate applets in System32 — populated here with directories chosen by this pipeline, not supplied by MITRE. Two structural weaknesses follow from that shape and are worth knowing before you deploy it. First, the .cpl clause and the path clause are independent contains over the same string, so nothing requires them to belong to the same token: control.exe C:\Windows\System32\desk.cpl plus any unrelated argument mentioning \Temp\ satisfies both. Second, the extension gate is the cheapest thing here to evade — Control_RunDLL loads whatever DLL it is handed, so rundll32.exe shell32.dll,Control_RunDLL invoice.dat is the same execution and never matches. Applets staged into System32, launched from UNC, or loaded through the CPlApplet API are likewise out of scope.

04 · Common false positives

Vendor installers and per-user installs that stage an applet under %LOCALAPPDATA% or %ProgramData% and open it via control.exe at the end of setup — recurring on every deployment and every product update. Software packaging agents such as Configuration Manager and Intune, which unpack into %WINDIR%\Temp or %ProgramData% then call rundll32.exe shell32.dll,Control_RunDLL. Help desk engineers copying an applet into %TEMP% to run it where the System32 copy is broken. And the independent- clause collision above, which fires on repair or copy arguments to rundll32.

05 · Detection maturity

tier_1: Lowest tier until it has been run against real data. Nothing here has touched a log line; it was authored from MITRE's prose and validated only for syntax and backend rendering. Treat the first week's volume as the measurement that decides whether medium survives.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Allowlist your packaging and deployment parents first — that is MITRE's ParentProcessName knob, applied with your own values, and it removes the two loudest sources at once. If you cannot identify those parents, low is a more defensible level than the shipped medium. To recover precision, replace the two independent clauses with one regex per writable root, roughly (?i)[A-Z]:\\Users\\[^\\]+\\(AppData|Downloads)\\[^"]*\.cpl, plus siblings for ProgramData and Windows\Temp. To recover coverage, add a companion rule on registry_add (Sysmon EventID 12) with TargetObject|contains on \CurrentVersion\Control Panel\Cpls\ — the registration arm AN0558 names, and a low-volume persistent observable. AN0558's file_event and image_load arms need the NewFileTimeWindow join, which Sigma cannot express.

Declared by the author

Vendor installers and per-user application installs that stage their own control panel applet under %LOCALAPPDATA% or %ProgramData% and open it through control.exe at the end of setup. This recurs on every deployment and every update of that product, and is best cut by allowlisting the installer parent process, which is MITRE's ParentProcessName knob applied with your own values.
Software packaging and deployment agents such as Configuration Manager or Intune, which unpack a payload into %WINDIR%\Temp or %ProgramData% and then invoke rundll32.exe shell32.dll,Control_RunDLL against the unpacked applet as part of a scripted install.
A help desk engineer copying a settings applet into %TEMP% or Downloads to run it on a machine where the System32 copy is missing, damaged, or blocked for that user.
Any command line that merely mentions a .cpl filename while also containing one of these directories without executing an applet, for example a copy, logging or repair argument passed to rundll32.exe, since the two contains clauses are evaluated independently of each other.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification2 runs

Verified in Siemphony lab

Security Datasets — Control Panel item (.cpl) executed as a proxy
passed
Siemphony IR · 3 Sept 2026
3 true · 0 false · 0.0% noise
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1218.002, evaluated against their process_creation events.

Share this rule

/u/siemphony/89981383-b1b5-4163-87d7-1ab30b051bcb

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Control panel item executed from a user-writable directory

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it