LegionLoader dllhost.exe CPL Applet Proxy Execution

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•4

Detects the execution of Control Panel (.cpl) files using rundll32.exe or dllhost.exe. Adversaries frequently use these system binaries to proxy the execution of malicious payloads, as .cpl files are technically DLLs that export CPlApplet functions and can bypass certain application allowlisting restrictions.