Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1218.002: Control Panel

Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings.

Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet function.[1][2] For ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel.[1] Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file.[1] [2][3]

Malicious Control Panel items can be delivered via Phishing campaigns[2][3] or executed as part of multi-stage malware.[4] Control Panel items, specifically CPL files, may also bypass application and/or file extension allow lists.

Adversaries may also rename malicious DLL files (.dll) with Control Panel file extensions (.cpl) and register them to HKCU\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls. Even when these registered DLLs do not comply with the CPL file specification and do not export CPlApplet functions, they are loaded and executed through its DllEntryPoint when Control Panel is executed. CPL files not exporting CPlApplet are not directly executable.[5]

EnterpriseT1218.002Sub-techniqueObject v3.0 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence High

Control Panel abuse matters because it turns a normal Windows component, control.exe, into a way to run malicious payloads that may look legitimate to users and some controls. The business risk is not the Control Panel itself; it is whether the organization can distinguish legitimate administrative setting changes from suspicious execution of .cpl files, renamed DLLs, or registered Control Panel items.

Executive priority

Prioritize this as a Windows defense-validation issue for stealthy execution and control bypass. Leaders should ask whether application control, endpoint logging, and SOC playbooks explicitly cover Control Panel item execution, not just obvious malware file types. It is especially relevant where allow lists, file-extension policies, or user-delivered attachments are relied on as evidence of execution prevention or compliance readiness.

Technical view

This is a Windows sub-technique of System Binary Proxy Execution. Defenders should validate visibility into control.exe launching or loading Control Panel items, including .cpl files that are renamed DLLs and registry-registered items under HKCU\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls. Because ATT&CK does not provide official detection text for this object, detection engineering should use the related strategy DET0194 as a starting point and test for malicious Control Panel item execution via control.exe or Rundll32. IR teams should treat suspicious .cpl execution, unusual parent-child process relationships, unexpected Control Panel registration, and user-delivered Control Panel items as triage pivots.

Likely telemetry

  • Windows process creation events for control.exe and rundll32.exe, including command line and parent process
  • File creation or modification events for .cpl files and renamed DLL-like payloads
  • DLL/image load telemetry showing Control Panel-related loading behavior
  • Registry monitoring for HKCU\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls
  • Email, web download, or endpoint file-origin metadata where .cpl files may arrive through phishing

Detection direction

  • Baseline normal control.exe usage by host role and user population, then alert on unusual parents, paths, command lines, or non-standard .cpl locations.
  • Validate DET0194-style coverage for malicious Control Panel item execution via control.exe or Rundll32 rather than relying only on generic malware signatures.
  • Tune for false positives from legitimate administrative tools and vendor Control Panel applets, but require explanation for user-writable paths, recent downloads, or attachment-originated .cpl files.
  • Check whether allow-list rules treat .cpl files differently from .exe files; ATT&CK notes CPL files may bypass application or file-extension allow lists.
  • Include registry-based registration of Control Panel items in monitoring, especially under the current-user Control Panel Cpls key.

Mitigation priorities

  • Apply execution prevention so only trusted and authorized code can run, with explicit consideration for .cpl files and signed-binary proxy execution paths.
  • Restrict file and directory permissions to reduce opportunities for users or processes to place executable content in sensitive or commonly abused locations.
  • Review application control and file-extension policies for gaps where renamed DLLs or Control Panel items are permitted by default.
  • Maintain SOC and IR procedures for collecting process, file, registry, and image-load evidence when suspicious Control Panel execution is reported.
Analyst notes and limits

Relationship context shows this technique is detected by DET0194 and mitigated by M1022 Restrict File and Directory Permissions and M1038 Execution Prevention. It is a sub-technique of T1218 System Binary Proxy Execution and has software-use relationships with Reaver and InvisiMole. Those relationships support defensive prioritization, but they should not be interpreted as evidence of current activity in any specific environment.

MITRE provides no official detection text for this object, so detection recommendations are derived from the official description and supplied relationships. Local baselines are required to separate legitimate Control Panel applet use from suspicious execution. Coverage also depends on whether the organization collects command-line, registry, file, and image-load telemetry on Windows endpoints.

Official MITRE ATT&CK definition

Control Panel

Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings.

Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet function.[1][2] For ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel.[1] Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file.[1] [2][3]

Malicious Control Panel items can be delivered via Phishing campaigns[2][3] or executed as part of multi-stage malware.[4] Control Panel items, specifically CPL files, may also bypass application and/or file extension allow lists.

Adversaries may also rename malicious DLL files (.dll) with Control Panel file extensions (.cpl) and register them to HKCU\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls. Even when these registered DLLs do not comply with the CPL file specification and do not export CPlApplet functions, they are loaded and executed through its DllEntryPoint when Control Panel is executed. CPL files not exporting CPlApplet are not directly executable.[5]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

2 rows
Domain ID Name Relationship / procedure
Enterprise T1218 System Binary Proxy Execution This object subtechnique of System Binary Proxy Execution.
Enterprise T1196 Control Panel Items Control Panel Items revoked by this object.
Associated objects

Groups, software, and campaigns

Malware Enterprise

S0260: InvisiMole

InvisiMole is a modular spyware program that has been used by the InvisiMole Group since at least 2013. InvisiMole has two backdoor modules called RC2FM and RC2CL that are used to perform post-exploitation activities. It has been discovered on compromised victims in the Ukraine and Russia. Gamaredon Group infrastructure has been used to download and execute InvisiMole against a small number of victims.[1][2]

Windows
Malware Enterprise

S0172: Reaver

Reaver is a malware family that has been in the wild since at least late 2016. Reporting indicates victims have primarily been associated with the "Five Poisons," which are movements the Chinese government considers dangerous. The type of malware is rare due to its final payload being in the form of Control Panel items.[1]

Windows
Relationship explorer

All related ATT&CK context

mitigates · Mitigation M1022: Restrict File and Directory Permissions Enterprise subtechnique of · Technique T1218: System Binary Proxy Execution Enterprise uses · Malware S0260: InvisiMole Enterprise detects · Detection Strategy DET0194: Detection of Malicious Control Panel Item Execution via control.exe or Rundll32 Enterprise mitigates · Mitigation M1038: Execution Prevention Enterprise uses · Malware S0172: Reaver Enterprise revoked by · Technique T1196: Control Panel Items Enterprise
Mitigations

Mitigation direction

Mitigation Enterprise

M1022: Restrict File and Directory Permissions

Restricting file and directory permissions involves setting access controls at the file system level to limit which users, groups, or processes can read, write, or execute files. By configuring permissions appropriately, organizations can reduce the attack surface for adversaries seeking to access sensitive data, plant malicious code, or tamper with system files.

Enforce Least Privilege Permissions:

- Remove unnecessary write permissions on sensitive files and directories. - Use file ownership and groups to control access for specific roles.

Example (Windows): Right-click the shared folder → Properties → Security tab → Adjust permissions for NTFS ACLs.

Harden File Shares:

- Disable anonymous access to shared folders. - Enforce NTFS permissions for shared folders on Windows.

Example: Set permissions to restrict write access to critical files, such as system executables (e.g., `/bin` or `/sbin` on Linux). Use tools like `chown` and `chmod` to assign file ownership and limit access.

On Linux, apply: `chmod 750 /etc/sensitive.conf` `chown root:admin /etc/sensitive.conf`

File Integrity Monitoring (FIM):

- Use tools like Tripwire, Wazuh, or OSSEC to monitor changes to critical file permissions.

Audit File System Access:

- Enable auditing to track permission changes or unauthorized access attempts. - Use auditd (Linux) or Event Viewer (Windows) to log activities.

Restrict Startup Directories:

- Configure permissions to prevent unauthorized writes to directories like `C:\ProgramData\Microsoft\Windows\Start Menu`.

Example: Restrict write access to critical directories like `/etc/`, `/usr/local/`, and Windows directories such as `C:\Windows\System32`.

- On Windows, use icacls to modify permissions: `icacls "C:\Windows\System32" /inheritance:r /grant:r SYSTEM:(OI)(CI)F` - On Linux, monitor permissions using tools like `lsattr` or `auditd`.

Mitigation Enterprise

M1038: Execution Prevention

Prevent the execution of unauthorized or malicious code on systems by implementing application control, script blocking, and other execution prevention mechanisms. This ensures that only trusted and authorized code is executed, reducing the risk of malware and unauthorized actions. This mitigation can be implemented through the following measures:

Application Control:

- Use Case: Use tools like AppLocker or Windows Defender Application Control (WDAC) to create whitelists of authorized applications and block unauthorized ones. On Linux, use tools like SELinux or AppArmor to define mandatory access control policies for application execution. - Implementation: Allow only digitally signed or pre-approved applications to execute on servers and endpoints. (e.g., `New-AppLockerPolicy -PolicyType Enforced -FilePath "C:\Policies\AppLocker.xml"`)

Script Blocking:

- Use Case: Use script control mechanisms to block unauthorized execution of scripts, such as PowerShell or JavaScript. Web Browsers: Use browser extensions or settings to block JavaScript execution from untrusted sources. - Implementation: Configure PowerShell to enforce Constrained Language Mode for non-administrator users. (e.g., `Set-ExecutionPolicy AllSigned`)

Executable Blocking:

- Use Case: Prevent execution of binaries from suspicious locations, such as `%TEMP%` or `%APPDATA%` directories. - Implementation: Block execution of `.exe`, `.bat`, or `.ps1` files from user-writable directories.

Dynamic Analysis Prevention: - Use Case: Use behavior-based execution prevention tools to identify and block malicious activity in real time. - Implemenation: Employ EDR solutions that analyze runtime behavior and block suspicious code execution.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
3.0
Created
Modified
Raw hash
cc4c9f6b77996732...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 3.0 Current bundle cc4c9f6b7799…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Microsoft Implementing CPL

    M. (n.d.). Implementing Control Panel Items. Retrieved January 18, 2018.

    Open source URL
  2. [2]
    TrendMicro CPL Malware Jan 2014

    Mercês, F. (2014, January 27). CPL Malware - Malicious Control Panel Items. Retrieved January 18, 2018.

    Open source URL
  3. [3]
    TrendMicro CPL Malware Dec 2013

    Bernardino, J. (2013, December 17). Control Panel Files Used As Malicious Attachments. Retrieved January 18, 2018.

    Open source URL
  4. [4]
    Palo Alto Reaver Nov 2017

    Grunzweig, J. and Miller-Osborn, J. (2017, November 10). New Malware with Ties to SunOrcal Discovered. Retrieved November 16, 2017.

    Open source URL
  5. [5]
    ESET InvisiMole June 2020

    Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.

    Open source URL
  6. [6]
    mitre-attack T1218.002
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use