Windows Process Creation: reg.exe adds Control Panel CPLs under CurrentVersion\Control Panel\CPLs

title: "Windows Process Creation: reg.exe adds Control Panel CPLs under CurrentVersion\\Control Panel\\CPLs"
id: a978af91-1a88-4289-8a5b-1f64ffe79c19
status: test
description: This rule flags Windows process creation events where reg.exe is used to add entries under CurrentVersion\Control Panel\CPLs, including cases where the command includes a .cpl file reference. Attackers can abuse Control Panel item registration to execute or persist via trusted system UI components, making this behavior high-risk. The detection relies on telemetry from process creation, specifically matching reg.exe image and command-line strings, along with filtering out some known system-related .cpl patterns.
references:
  - https://ired.team/offensive-security/code-execution/code-execution-through-control-panel-add-ins
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_control_panel_item.yml
author: Kyaw Min Thein, Furkan Caliskan (@caliskanfurkan_), Huntrule Team
date: 2020-06-22
modified: 2023-10-11
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1218.002
  - attack.persistence
  - attack.t1546
logsource:
  product: windows
  category: process_creation
detection:
  selection_reg_img:
    - Image|endswith: \reg.exe
    - OriginalFileName: reg.exe
  selection_reg_cli:
    CommandLine|contains|all:
      - add
      - CurrentVersion\Control Panel\CPLs
  selection_cpl:
    CommandLine|endswith: .cpl
  filter_cpl_sys:
    CommandLine|contains:
      - \System32\
      - "%System%"
      - "|C:\\Windows\\system32|"
  filter_cpl_igfx:
    CommandLine|contains|all:
      - "regsvr32 "
      - " /s "
      - igfxCPL.cpl
  condition: all of selection_reg_* or (selection_cpl and not 1 of filter_cpl_*)
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 0ba863e6-def5-4e50-9cea-4dd8c7dc46a4
    type: derived