CyberStack

MITRE ATT&CK / Techniques / T1218.002

System Binary Proxy Execution: Control Panel

ID
T1218.002
Tactics
TA0005 Stealth
Sub-technique of
T1218 System Binary Proxy Execution
Platforms
Windows
Data sources
Process Creation, File Creation, Module Load, Windows Registry Key Creation
Source
attack.mitre.org
MITRE last modified
12 May 2026

Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings.

Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet function.[7][8] For ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel.[7] Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file.[7] [8][9]

Malicious Control Panel items can be delivered via Phishing campaigns[8][9] or executed as part of multi-stage malware.[10] Control Panel items, specifically CPL files, may also bypass application and/or file extension allow lists.

Adversaries may also rename malicious DLL files (.dll) with Control Panel file extensions (.cpl) and register them to HKCU\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls. Even when these registered DLLs do not comply with the CPL file specification and do not export CPlApplet functions, they are loaded and executed through its DllEntryPoint when Control Panel is executed. CPL files not exporting CPlApplet are not directly executable.[11]

Detection

Mitigations (2)

M1022 Restrict File and Directory Permissions

Restrict storage and execution of Control Panel items to protected directories, such as C:\Windows, rather than user directories.

M1038 Execution Prevention

Identify and block potentially malicious and unknown .cpl files by using application control [1] tools, like Windows Defender Application Control[2], AppLocker, [3] [4] or Software Restriction Policies [5] where appropriate. [6]

Software (2)

References

  1. Beechey 2010
  2. Microsoft Windows Defender Application Control
  3. Windows Commands JPCERT
  4. NSA MS AppLocker
  5. Corio 2008
  6. TechNet Applocker vs SRP
  7. Microsoft Implementing CPL
  8. TrendMicro CPL Malware Jan 2014
  9. TrendMicro CPL Malware Dec 2013
  10. Palo Alto Reaver Nov 2017
  11. ESET InvisiMole June 2020