T1218.002: Control Panel

Control Panel abuse matters because it turns a normal Windows component, control.exe, into a way to run malicious payloads that may look legitimate to users and some controls. The business risk is not the Control Panel itself; it is whether the organization can distinguish legitimate administrative setting changes from suspicious execution of .cpl files, renamed DLLs, or registered Control Panel items.

Executive priority

Prioritize this as a Windows defense-validation issue for stealthy execution and control bypass. Leaders should ask whether application control, endpoint logging, and SOC playbooks explicitly cover Control Panel item execution, not just obvious malware file types. It is especially relevant where allow lists, file-extension policies, or user-delivered attachments are relied on as evidence of execution prevention or compliance readiness.

Technical view

This is a Windows sub-technique of System Binary Proxy Execution. Defenders should validate visibility into control.exe launching or loading Control Panel items, including .cpl files that are renamed DLLs and registry-registered items under HKCU\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls. Because ATT&CK does not provide official detection text for this object, detection engineering should use the related strategy DET0194 as a starting point and test for malicious Control Panel item execution via control.exe or Rundll32. IR teams should treat suspicious .cpl execution, unusual parent-child process relationships, unexpected Control Panel registration, and user-delivered Control Panel items as triage pivots.

Likely telemetry

Windows process creation events for control.exe and rundll32.exe, including command line and parent process
File creation or modification events for .cpl files and renamed DLL-like payloads
DLL/image load telemetry showing Control Panel-related loading behavior
Registry monitoring for HKCU\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls
Email, web download, or endpoint file-origin metadata where .cpl files may arrive through phishing

Detection direction

Baseline normal control.exe usage by host role and user population, then alert on unusual parents, paths, command lines, or non-standard .cpl locations.
Validate DET0194-style coverage for malicious Control Panel item execution via control.exe or Rundll32 rather than relying only on generic malware signatures.
Tune for false positives from legitimate administrative tools and vendor Control Panel applets, but require explanation for user-writable paths, recent downloads, or attachment-originated .cpl files.
Check whether allow-list rules treat .cpl files differently from .exe files; ATT&CK notes CPL files may bypass application or file-extension allow lists.
Include registry-based registration of Control Panel items in monitoring, especially under the current-user Control Panel Cpls key.

Mitigation priorities

Apply execution prevention so only trusted and authorized code can run, with explicit consideration for .cpl files and signed-binary proxy execution paths.
Restrict file and directory permissions to reduce opportunities for users or processes to place executable content in sensitive or commonly abused locations.
Review application control and file-extension policies for gaps where renamed DLLs or Control Panel items are permitted by default.
Maintain SOC and IR procedures for collecting process, file, registry, and image-load evidence when suspicious Control Panel execution is reported.

Additional notes and limits

Relationship context shows this technique is detected by DET0194 and mitigated by M1022 Restrict File and Directory Permissions and M1038 Execution Prevention. It is a sub-technique of T1218 System Binary Proxy Execution and has software-use relationships with Reaver and InvisiMole. Those relationships support defensive prioritization, but they should not be interpreted as evidence of current activity in any specific environment.

MITRE provides no official detection text for this object, so detection recommendations are derived from the official description and supplied relationships. Local baselines are required to separate legitimate Control Panel applet use from suspicious execution. Coverage also depends on whether the organization collects command-line, registry, file, and image-load telemetry on Windows endpoints.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Control Panel

Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings.

Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet function.[1][2] For ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel.[1] Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file.[1] [2][3]

Malicious Control Panel items can be delivered via Phishing campaigns[2][3] or executed as part of multi-stage malware.[4] Control Panel items, specifically CPL files, may also bypass application and/or file extension allow lists.

Adversaries may also rename malicious DLL files (.dll) with Control Panel file extensions (.cpl) and register them to HKCU\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls. Even when these registered DLLs do not comply with the CPL file specification and do not export CPlApplet functions, they are loaded and executed through its DllEntryPoint when Control Panel is executed. CPL files not exporting CPlApplet are not directly executable.[5]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques2 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1218	System Binary Proxy Execution	This object subtechnique of System Binary Proxy Execution.
Enterprise	T1196	Control Panel Items	Control Panel Items revoked by this object.

Associated objects

Groups, software, and campaigns

S0260: InvisiMole

InvisiMole is a modular spyware program that has been used by the InvisiMole Group since at least 2013. InvisiMole has two backdoor modules called RC2FM and RC2CL that are used to perform post-exploitation activities. It has been discovered on compromised victims in the Ukraine and Russia. Gamaredon Group infrastructure has been used to download and execute InvisiMole against a small number of victims.[1][2]

Windows

S0172: Reaver

Reaver is a malware family that has been in the wild since at least late 2016. Reporting indicates victims have primarily been associated with the "Five Poisons," which are movements the Chinese government considers dangerous. The type of malware is rare due to its final payload being in the form of Control Panel items.[1]

Windows

Relationship explorer

All related ATT&CK context

mitigates · MitigationM1022: Restrict File and Directory PermissionsEnterprise subtechnique of · TechniqueT1218: System Binary Proxy ExecutionEnterprise uses · MalwareS0260: InvisiMoleEnterprise detects · Detection StrategyDET0194: Detection of Malicious Control Panel Item Execution via control.exe or Rundll32Enterprise mitigates · MitigationM1038: Execution PreventionEnterprise uses · MalwareS0172: ReaverEnterprise revoked by · TechniqueT1196: Control Panel ItemsEnterprise

Mitigations

Mitigation direction

M1022: Restrict File and Directory Permissions

Restricting file and directory permissions involves setting access controls at the file system level to limit which users, groups, or processes can read, write, or execute files. By configuring permissions appropriately, organizations can reduce the attack surface for adversaries seeking to access sensitive data, plant malicious code, or tamper with system files.

Enforce Least Privilege Permissions:

- Remove unnecessary write permissions on sensitive files and directories. - Use file ownership and groups to control access for specific roles.

Example (Windows): Right-click the shared folder → Properties → Security tab → Adjust permissions for NTFS ACLs.

Harden File Shares:

- Disable anonymous access to shared folders. - Enforce NTFS permissions for shared folders on Windows.

Example: Set permissions to restrict write access to critical files, such as system executables (e.g., `/bin` or `/sbin` on Linux). Use tools like `chown` and `chmod` to assign file ownership and limit access.

On Linux, apply: `chmod 750 /etc/sensitive.conf` `chown root:admin /etc/sensitive.conf`

File Integrity Monitoring (FIM):

- Use tools like Tripwire, Wazuh, or OSSEC to monitor changes to critical file permissions.

Audit File System Access:

- Enable auditing to track permission changes or unauthorized access attempts. - Use auditd (Linux) or Event Viewer (Windows) to log activities.

Restrict Startup Directories:

- Configure permissions to prevent unauthorized writes to directories like `C:\ProgramData\Microsoft\Windows\Start Menu`.

Example: Restrict write access to critical directories like `/etc/`, `/usr/local/`, and Windows directories such as `C:\Windows\System32`.

- On Windows, use icacls to modify permissions: `icacls "C:\Windows\System32" /inheritance:r /grant:r SYSTEM:(OI)(CI)F` - On Linux, monitor permissions using tools like `lsattr` or `auditd`.

M1038: Execution Prevention

Prevent the execution of unauthorized or malicious code on systems by implementing application control, script blocking, and other execution prevention mechanisms. This ensures that only trusted and authorized code is executed, reducing the risk of malware and unauthorized actions. This mitigation can be implemented through the following measures:

Application Control:

- Use Case: Use tools like AppLocker or Windows Defender Application Control (WDAC) to create whitelists of authorized applications and block unauthorized ones. On Linux, use tools like SELinux or AppArmor to define mandatory access control policies for application execution. - Implementation: Allow only digitally signed or pre-approved applications to execute on servers and endpoints. (e.g., `New-AppLockerPolicy -PolicyType Enforced -FilePath "C:\Policies\AppLocker.xml"`)

Script Blocking:

- Use Case: Use script control mechanisms to block unauthorized execution of scripts, such as PowerShell or JavaScript. Web Browsers: Use browser extensions or settings to block JavaScript execution from untrusted sources. - Implementation: Configure PowerShell to enforce Constrained Language Mode for non-administrator users. (e.g., `Set-ExecutionPolicy AllSigned`)

Executable Blocking:

- Use Case: Prevent execution of binaries from suspicious locations, such as `%TEMP%` or `%APPDATA%` directories. - Implementation: Block execution of `.exe`, `.bat`, or `.ps1` files from user-writable directories.

Dynamic Analysis Prevention: - Use Case: Use behavior-based execution prevention tools to identify and block malicious activity in real time. - Implemenation: Employ EDR solutions that analyze runtime behavior and block suspicious code execution.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 19.1
Object version: 3.0
Created: Jan 23, 2020, 19:59 UTC (UTC+00:00)
Modified: May 12, 2026, 15:12 UTC (UTC+00:00)
Raw hash: cc4c9f6b77996732...

Imported snapshots across ATT&CK releases(1)

Release	Bundle imported	Object version	Modified	Status	Raw hash
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	3.0	May 12, 2026, 15:12 UTC (UTC+00:00)	Current bundle	`cc4c9f6b7799…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
Microsoft Implementing CPL
M. (n.d.). Implementing Control Panel Items. Retrieved January 18, 2018.
Open source URL
[2]
TrendMicro CPL Malware Jan 2014
Mercês, F. (2014, January 27). CPL Malware - Malicious Control Panel Items. Retrieved January 18, 2018.
Open source URL
[3]
TrendMicro CPL Malware Dec 2013
Bernardino, J. (2013, December 17). Control Panel Files Used As Malicious Attachments. Retrieved January 18, 2018.
Open source URL
[4]
Palo Alto Reaver Nov 2017
Grunzweig, J. and Miller-Osborn, J. (2017, November 10). New Malware with Ties to SunOrcal Discovered. Retrieved November 16, 2017.
Open source URL
[5]
ESET InvisiMole June 2020
Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.
Open source URL
[6]
Beechey 2010
Beechey, J. (2010, December). Application Whitelisting: Panacea or Propaganda?. Retrieved November 18, 2014.
[7]
Microsoft Windows Defender Application Control
Gorzelany, A., Hall, J., Poggemeyer, L.. (2019, January 7). Windows Defender Application Control. Retrieved July 16, 2019.
Open source URL
[8]
Windows Commands JPCERT
Tomonaga, S. (2016, January 26). Windows Commands Abused by Attackers. Retrieved February 2, 2016.
Open source URL
[9]
NSA MS AppLocker
NSA Information Assurance Directorate. (2014, August). Application Whitelisting Using Microsoft AppLocker. Retrieved March 31, 2016.
Open source URL
[10]
Corio 2008
Corio, C., & Sayana, D. P. (2008, June). Application Lockdown with Software Restriction Policies. Retrieved September 12, 2024.
Open source URL
[11]
TechNet Applocker vs SRP
Microsoft. (2012, June 27). Using Software Restriction Policies and AppLocker Policies. Retrieved April 7, 2016.
Open source URL
[12]
ESET InvisiMole June 2020
Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.
Open source URL
[13]
ESET InvisiMole June 2020
Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.
Open source URL
[14]
Microsoft Implementing CPL
M. (n.d.). Implementing Control Panel Items. Retrieved January 18, 2018.
Open source URL
[15]
Microsoft Implementing CPL
M. (n.d.). Implementing Control Panel Items. Retrieved January 18, 2018.
Open source URL
[16]
Palo Alto Reaver Nov 2017
Grunzweig, J. and Miller-Osborn, J. (2017, November 10). New Malware with Ties to SunOrcal Discovered. Retrieved November 16, 2017.
Open source URL
[17]
Palo Alto Reaver Nov 2017
Grunzweig, J. and Miller-Osborn, J. (2017, November 10). New Malware with Ties to SunOrcal Discovered. Retrieved November 16, 2017.
Open source URL
[18]
TrendMicro CPL Malware Dec 2013
Bernardino, J. (2013, December 17). Control Panel Files Used As Malicious Attachments. Retrieved January 18, 2018.
Open source URL
[19]
TrendMicro CPL Malware Dec 2013
Bernardino, J. (2013, December 17). Control Panel Files Used As Malicious Attachments. Retrieved January 18, 2018.
Open source URL
[20]
TrendMicro CPL Malware Jan 2014
Mercês, F. (2014, January 27). CPL Malware - Malicious Control Panel Items. Retrieved January 18, 2018.
Open source URL
[21]
TrendMicro CPL Malware Jan 2014
Mercês, F. (2014, January 27). CPL Malware - Malicious Control Panel Items. Retrieved January 18, 2018.
Open source URL
[22]
mitre-attackT1218.002
Open source URL
[23]
mitre-attackT1218.002
Open source URL
[24]
mitre-attackT1218.002
Open source URL
[25]
ESET InvisiMole June 2020
Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.
Open source URL
[26]
ESET InvisiMole June 2020
Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.
Open source URL
[27]
Beechey 2010
Beechey, J. (2010, December). Application Whitelisting: Panacea or Propaganda?. Retrieved November 18, 2014.
[28]
Corio 2008
Corio, C., & Sayana, D. P. (2008, June). Application Lockdown with Software Restriction Policies. Retrieved September 12, 2024.
Open source URL
[29]
Microsoft Windows Defender Application Control
Gorzelany, A., Hall, J., Poggemeyer, L.. (2019, January 7). Windows Defender Application Control. Retrieved July 16, 2019.
Open source URL
[30]
NSA MS AppLocker
NSA Information Assurance Directorate. (2014, August). Application Whitelisting Using Microsoft AppLocker. Retrieved March 31, 2016.
Open source URL
[31]
TechNet Applocker vs SRP
Microsoft. (2012, June 27). Using Software Restriction Policies and AppLocker Policies. Retrieved April 7, 2016.
Open source URL
[32]
Windows Commands JPCERT
Tomonaga, S. (2016, January 26). Windows Commands Abused by Attackers. Retrieved February 2, 2016.
Open source URL
[33]
Palo Alto Reaver Nov 2017
Grunzweig, J. and Miller-Osborn, J. (2017, November 10). New Malware with Ties to SunOrcal Discovered. Retrieved November 16, 2017.
Open source URL
[34]
Palo Alto Reaver Nov 2017
Grunzweig, J. and Miller-Osborn, J. (2017, November 10). New Malware with Ties to SunOrcal Discovered. Retrieved November 16, 2017.
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use