Control Panel Items Manipulation
This rule detects attempts to manipulate Control Panel Items, which can be used by adversaries for privilege escalation, execution, or defense evasion. It specifically looks for two main scenarios: 1) The use of 'reg.exe' to add entries to the 'CurrentVersion\Control Panel\CPLs' registry key, which is a known method for registering malicious Control Panel items. 2) The execution of '.cpl' files outside of standard system directories, indicating potentially malicious or unusual Control Panel item activity. The rule filters out common legitimate system CPL executions to reduce false positives.
Sigma
