System Control Panel Item Loaded From Uncommon Location
Detects image load events of system control panel items (.cpl) from uncommon or non-system locations which might be the result of sideloading. This technique can be used for defense evasion by masquerading malicious code as legitimate system components.
Sigma
