windows enabled community high v1.0.0

control

Binary used to launch controlpanel items in Windows Located at: C:\Windows\System32\control.exe; C:\Windows\SysWOW64\control.exe.

📋 Live Preview 
control
control

Sandbox: execFile · Timeout: 30s

Capabilities

system.file.alternate-data-stream
security.execution.command

Contract

Outputs

process.output

Command execution output

Side effects: filesystem_writeprocess_spawn

Workflow Edges

Produces

process.output

Resource Profile

ResourceValue
CPUlow
Memory16 MB
Networklow
Disk I/Olow

Examples

Execute evil.dll which is stored in an Alternate Data Stream (ADS). (Can be used to evade defensive countermeasures or to hide as a persistence mechanism)

control.exe {PATH_ABSOLUTE}:evil.dll

Execute .cpl file. A CPL is a DLL file with CPlApplet export function) (Use to execute code and bypass application whitelisting)

control.exe {PATH_ABSOLUTE:.cpl}

Detection

TypeRule / Indicator
sigma https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules-emerging-threats/2021/Exploits/CVE-2021-40444/proc_creation_win_exploit_cve_2021_40444.yml
sigma https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_control_dll_load.yml
elastic https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_network_connection_from_windows_binary.toml
elastic https://github.com/elastic/detection-rules/blob/0875c1e4c4370ab9fbf453c8160bb5abc8ad95e7/rules/windows/defense_evasion_execution_control_panel_suspicious_args.toml
elastic https://github.com/elastic/detection-rules/blob/61afb1c1c0c3f50637b1bb194f3e6fb09f476e50/rules/windows/defense_evasion_unusual_dir_ads.toml
ioc Control.exe executing files from alternate data streams
ioc Control.exe executing library file without cpl extension
ioc Suspicious network connections from control.exe

Documentation

control

control is a Windows LOLBin. Binary used to launch controlpanel items in Windows Located at: C:\Windows\System32\control.exe; C:\Windows\SysWOW64\control.exe.

References