T1218.002.md

T1218.002 - Control Panel

Description from ATT&CK

Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings. Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet function. (Citation: Microsoft Implementing CPL) (Citation: TrendMicro CPL Malware Jan 2014) Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file. (Citation: Microsoft Implementing CPL) (Citation: TrendMicro CPL Malware Jan 2014) (Citation: TrendMicro CPL Malware Dec 2013)

For ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel. (Citation: Microsoft Implementing CPL)

Malicious Control Panel items can be delivered via Phishing campaigns (Citation: TrendMicro CPL Malware Jan 2014) (Citation: TrendMicro CPL Malware Dec 2013) or executed as part of multi-stage malware. (Citation: Palo Alto Reaver Nov 2017) Control Panel items, specifically CPL files, may also bypass application and/or file extension allow lists.

Atomic Tests

• Atomic Test #1 - Control Panel Items

Atomic Test #1 - Control Panel Items

This test simulates an adversary leveraging control.exe Upon execution calc.exe will be launched

Supported Platforms: Windows

Inputs:

Name	Description	Type	Default Value
cpl_file_path	path to cpl file	path	PathToAtomicsFolder\T1218.002\bin\calc.cpl

Attack Commands: Run with command_prompt!

control.exe #{cpl_file_path}

Dependencies: Run with powershell!

Description: Cpl file must exist on disk at specified location (#{cpl_file_path})

Check Prereq Commands:

if (Test-Path #{cpl_file_path}) {exit 0} else {exit 1} 

Get Prereq Commands:

New-Item -Type Directory (split-path #{cpl_file_path}) -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.002/bin/calc.cpl" -OutFile "#{cpl_file_path}"