Windows .cpl Image Loads From Non-System Paths

title: Windows .cpl Image Loads From Non-System Paths
id: d165805e-50dc-4d16-a081-b125f63f83e2
status: test
description: This rule flags Windows image load events where .cpl system control panel items are loaded from locations other than common system directories. Loading .cpl files from uncommon paths can indicate DLL/CPL side-loading or other abuse used for stealthy execution and persistence. It relies on telemetry from Windows image_load events and matches process image paths ending with specific .cpl filenames while excluding known legitimate system locations.
references:
  - https://www.hexacorn.com/blog/2024/01/06/1-little-known-secret-of-fondue-exe/
  - https://www.hexacorn.com/blog/2024/01/01/1-little-known-secret-of-hdwwiz-exe/
  - https://github.com/mhaskar/FsquirtCPLPoC
  - https://securelist.com/sidewinder-apt/114089/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_cpl_from_non_system_location.yml
author: Anish Bogati, Huntrule Team
date: 2024-01-09
modified: 2026-02-17
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  product: windows
  category: image_load
detection:
  selection:
    ImageLoaded|endswith:
      - \appwiz.cpl
      - \bthprops.cpl
      - \hdwwiz.cpl
  filter_main_legit_location:
    ImageLoaded|startswith:
      - C:\Windows\Prefetch\
      - C:\Windows\System32\
      - C:\Windows\SysWOW64\
      - C:\Windows\WinSxS\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/image_load/image_load_side_load_cpl_from_non_system_location/info.yml
license: DRL-1.1
related:
  - id: 2b140a5c-dc02-4bb8-b6b1-8bdb45714cde
    type: derived