Control Panel Items

Title: Control Panel Items
Status: test
Description:Detects the malicious use of a control panel item
References:
  -https://ired.team/offensive-security/code-execution/code-execution-through-control-panel-add-ins
Author: Kyaw Min Thein, Furkan Caliskan (@caliskanfurkan_)
Date: 2020-06-22
modified:2023-10-11
Tags:

• -'attack.privilege-escalation'
• -'attack.execution'
• -'attack.stealth'
• -'attack.t1218.002'
• -'attack.persistence'
• -'attack.t1546'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection_reg_img:
Image|endswith:'\reg.exe' OriginalFileName:'reg.exe'   selection_reg_cli:
    CommandLine|contains|all:
      -'add'
      -'CurrentVersion\Control Panel\CPLs'

  selection_cpl:
    CommandLine|endswith: '.cpl'
  filter_cpl_sys:
    CommandLine|contains:
      -'\System32\'
      -'%System%'
      -'|C:\Windows\system32|'

  filter_cpl_igfx:
    CommandLine|contains|all:
      -'regsvr32 '
      -' /s '
      -'igfxCPL.cpl'

  condition:all of selection_reg_* or (selection_cpl and not 1 of filter_cpl_*)
Falsepositives:
  -Unknown
Level: high