huntrule

Windows Process Creation: Detect reg.exe Add Control Panel CPL Items

Alerts on reg.exe adding Control Panel CPL items via CurrentVersion\Control Panel\CPLs, a common vector for stealthy execution/persistence.

FreeReviewedSigma · High · v2
Product
windows
Category
process_creation
Author
Kyaw Min Thein, Furkan Caliskan (@caliskanfurkan_) (SigmaHQ), DRL 1.1
Published
2020-06-22
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Persistence → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies Windows process executions where reg.exe is used with arguments that add entries under CurrentVersion\Control Panel\CPLs, indicating a potential malicious Control Panel item persistence technique. It also looks for suspicious creation of entries related to .cpl execution, excluding common system or OEM-related paths when the process line matches known patterns. Telemetry required includes process creation events with Image, OriginalFileName, and CommandLine fields.

Reporting behind it

Related detections9 linkedT1546 — drag to rearrange
Suspicious Python Path Configuration Hook Persistence (via file_event)
Suspicious Zsh Persistence via zshrc_aliases Appended to Shell Startup (via process_creation)
Malicious UNC4841 Dropper Deployment to Boot Partition via mknod (via process_creation)
Suspicious NetworkManager Dispatcher Script Persistence
Suspicious APT Or YUM Package Manager Hook Configuration Created
AdminSDHolder Permissions Changed for Persistence (via security)
Suspicious Persistence via Shell Script Dropped in profile.d Directory (via file_event)
Suspicious Command Processor AutoRun Persistence via Registry Set
Suspicious Python Site Hook or PTH File Written to Site-Packages via File Event
Windows Process Creation: Detect reg.exe Add Control Panel CPL Items
Pivot detection · T1546 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.