LegionLoader: dllhost.exe Proxy Execution of Malicious .cpl Applet

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•7

Detects instances where the Windows COM Surrogate process (dllhost.exe) is executed with a command line argument referencing a .cpl (Control Panel) file. This behavior is indicative of an attempt to proxy malicious code execution via the Control Panel utility, a technique often used to evade application allowlisting.