Control panel applet from user path
A Control Panel applet (.cpl) executed from a user-writable directory.
What it detects
A Control Panel applet (.cpl) executed from a user-writable directory. A .cpl is simply a DLL with a CPlApplet export, and both control.exe and rundll32 shell32.dll,Control_RunDLL will load one from any path. Because the extension is not .dll or .exe it slips past naive extension filtering, and mail gateways have historically treated it as inert — which is why commodity loaders ship .cpl payloads inside archives.
Genuine applets ship in C:\Windows\System32. This rule requires the path to be somewhere a user can write, which is what separates an attack from opening a system settings page.
MITRE ATT&CK mapping
- T1218.002System Binary Proxy Execution: Control Panel· Defense Evasion
False positives and triage
Rare. Some third-party drivers and vendor utilities install a .cpl outside System32, though usually under Program Files, which is not matched here.
To confirm: the .cpl is a DLL — hash it and treat it as a suspicious binary, not as a settings file. Check how it arrived (a browser download, an archive extracted from mail) and what the loading process did next. A .cpl in a Downloads folder with an invoice-style name is a commodity phishing payload.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 80%. Source: rules/windows/control_panel_applet_from_user_path.yaml, licensed under the Apache License 2.0.
id: windows.execution.control_panel_applet_from_user_path
version: 1.0.0
status: stable
severity: high
confidence: 0.8
platforms: [windows]
mitre_techniques: [T1218.002]
description: |
A Control Panel applet (`.cpl`) executed from a user-writable directory. A .cpl is
simply a DLL with a `CPlApplet` export, and both `control.exe` and
`rundll32 shell32.dll,Control_RunDLL` will load one from any path. Because the
extension is not `.dll` or `.exe` it slips past naive extension filtering, and mail
gateways have historically treated it as inert — which is why commodity loaders
ship .cpl payloads inside archives.
Genuine applets ship in `C:\Windows\System32`. This rule requires the path to be
somewhere a user can write, which is what separates an attack from opening a
system settings page.
match:
command_line_regex: '(?i)[a-z]:\\(users|programdata|windows\\temp|temp|perflogs)\\[^"]*\.cpl'
correlation_keys: [hostname, user_name]
false_positive_guidance: |
Rare. Some third-party drivers and vendor utilities install a .cpl outside
System32, though usually under `Program Files`, which is not matched here.
To confirm: the .cpl is a DLL — hash it and treat it as a suspicious binary, not
as a settings file. Check how it arrived (a browser download, an archive extracted
from mail) and what the loading process did next. A .cpl in a Downloads folder
with an invoice-style name is a commodity phishing payload.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.