Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
43 detections
Filters
Last updated
All Time
Detection languages
25
9
5
1
1
Contributors
16
8
4
4
4
Categories
39
14
11
6
6
Platforms
41
6
1
1
Products / Services
17
16
8
6
5
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
5
IDS Classtypes
1
IDS Protocols
1
Detects the execution of control.exe or rundll32.exe with command line arguments pointing to .cpl files located in non-standard, user-writable directories such as Temp, AppData, Downloads, or Users/Public. This is a common technique used by adversaries to proxy execution of malicious payloads while bypassing standard path restrictions.
Detects the execution of 'rundll32.exe' or 'dllhost.exe' with command-line arguments typically associated with loading Control Panel items (.cpl files). This behavior is often used by adversaries to proxy execution of malicious payloads or bypass security controls by leveraging legitimate Windows binaries.
Detects the execution of Control Panel (.cpl) files via control.exe from non-standard system directories, or the use of rundll32.exe to invoke CPL applets. These methods are commonly used to proxy malicious code execution while appearing legitimate.
Detects instances where the Windows COM Surrogate process (dllhost.exe) is executed with a command line argument referencing a .cpl (Control Panel) file. This behavior is indicative of an attempt to proxy malicious code execution via the Control Panel utility, a technique often used to evade application allowlisting.
Detects the execution of Control Panel applets (.cpl) via unconventional proxy binaries like dllhost.exe or rundll32.exe. This pattern is commonly observed in malware attempting to execute malicious DLLs by leveraging Windows system binaries to bypass security controls and application whitelisting.
Detects the execution of Control Panel (.cpl) files using rundll32.exe or dllhost.exe. Adversaries frequently use these system binaries to proxy the execution of malicious payloads, as .cpl files are technically DLLs that export CPlApplet functions and can bypass certain application allowlisting restrictions.
Detects malicious Control Panel (.cpl) file execution via legitimate Windows binaries like dllhost.exe or rundll32.exe. Attackers often abuse these binaries to bypass security controls. The rule specifically alerts on instances where these processes are launched from non-standard parent processes or from high-risk directories such as AppData or Temp.
Detects the execution of the dllhost.exe process with command-line arguments referencing .cpl files or the 'COpenControlPanel' string. This behavior is indicative of potential malicious activity where attackers use Control Panel files (which are essentially DLLs) to proxy code execution, potentially to bypass security controls or masquerade as legitimate system activity.
Detects execution of Control Panel CPL files for LOLBin proxy execution
This rule detects the delivery of a malicious Control Panel (.cpl) file over HTTP. It specifically looks for HTTP responses containing a URI ending with ".cpl" (case-insensitive) and the "MZ" magic bytes at the beginning of the file data, indicating an executable file. This technique is often used for defense evasion and to execute malicious code.
Identifies process execution events or command lines that reference a Control Panel (.cpl) file hosted on a remote UNC path. This isolates the APT28 technique used in CVE-2026-21510 to load remote payloads as CPL objects.
Identifies process execution events or command lines that reference a Control Panel (.cpl) file hosted on a remote UNC path. This isolates the APT28 technique used in CVE-2026-21510 to load remote payloads as CPL objects.
Control Panel Items
Sigma
Detects the malicious use of a control panel item
This rule detects attempts to manipulate Control Panel Items, which can be used by adversaries for privilege escalation, execution, or defense evasion. It specifically looks for two main scenarios: 1) The use of 'reg.exe' to add entries to the 'CurrentVersion\Control Panel\CPLs' registry key, which is a known method for registering malicious Control Panel items. 2) The execution of '.cpl' files outside of standard system directories, indicating potentially malicious or unusual Control Panel item activity. The rule filters out common legitimate system CPL executions to reduce false positives.
Control Panel Items
Sigma
Detects the malicious use of a control panel item
Control Panel Items
Sigma
Detects the malicious use of a control panel item
'This hunting query identifies Zoom room systems with high CPU alerts that may be a sign of device compromise.'
The analytic identifies instances of `control.exe` loading a `.cpl` or `.inf` file from a world-writable directory (e.g., `appdata`, `windows\temp`, `programdata`). This activity is often associated with attempts to exploit vulnerabilities like CVE-2021-40444, which could lead to unauthorized code execution and system compromise. The detection leverages process names and command-line executions from EDR agents.
The analytic identifies instances of rundll32.exe executing with `Control_RunDLL` in the command line, which is indicative of loading a .cpl or other file types. This activity is significant as rundll32.exe can be exploited to execute malicious Control Panel Item files, potentially linked to CVE-2021-40444. If confirmed malicious, this could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment.
The analytic identifies instances where `control.exe` is spawned by a Microsoft Office product. This activity can indicate exploitation attempts, specifically related to CVE-2021-40444, where `control.exe` is used to execute malicious .cpl or .inf files. If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network.
Detects potential exploitation of CVE-2021-40444, a Microsoft MSHTML Remote Code Execution vulnerability, by identifying suspicious process patterns. Specifically, it looks for 'control.exe' being spawned by Microsoft Office applications (Winword, Powerpnt, Excel) with command-line arguments that do not match known benign patterns for 'control.exe input.dll'. This behavior has been observed in in-the-wild exploitations of this vulnerability.
Page 2 of 3