Windows Process Creation: Detect reg.exe Add Control Panel CPL Items

Alerts on reg.exe adding Control Panel CPL items via CurrentVersion\Control Panel\CPLs, a common vector for stealthy execution/persistence.

FreeReviewedSigma · High · v2

Product: windows
Category: process_creation
Author: Kyaw Min Thein, Furkan Caliskan (@caliskanfurkan_) (SigmaHQ), DRL 1.1
Published: 2020-06-22
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Persistence → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1546Event Triggered Execution
Priv Esc
- T1546Event Triggered Execution
Defense Evasion
- T1218.002Control Panel
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Windows process executions where reg.exe is used with arguments that add entries under CurrentVersion\Control Panel\CPLs, indicating a potential malicious Control Panel item persistence technique. It also looks for suspicious creation of entries related to .cpl execution, excluding common system or OEM-related paths when the process line matches known patterns. Telemetry required includes process creation events with Image, OriginalFileName, and CommandLine fields.

Reporting behind it

Related detections9 linkedT1546 — drag to rearrange

AdminSDHolder Permissions Changed for Persistence (via security)

Suspicious Persistence via Shell Script Dropped in profile.d Directory (via file_event)

Suspicious Command Processor AutoRun Persistence via Registry Set

Suspicious Python Site Hook or PTH File Written to Site-Packages via File Event

Suspicious MOTD Or Git Hook Script Creation For Linux Persistence

Suspicious Control Panel File Execution via control.exe with CPL Argument

Windows: Suspicious Outlook VbaProject.OTM Macro File Created

Windows MSSQL: Extended Stored Procedure execution with provider name MSSQLSERVER and message containing 'maggie'

Windows: File Creation of Get-Variable.exe in PowerShell WindowsApps Path

Windows Process Creation: Detect reg.exe Add Control Panel CPL Items

Pivot detection · T1546 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-reg-exe-adds-control-panel-cpls-under-currentversion-co-0ba863e6

title: "Windows Process Creation: Detect reg.exe Add Control Panel CPL Items"
id: a978af91-1a88-4289-8a5b-1f64ffe79c19
status: test
description: This rule identifies Windows process executions where reg.exe is used with arguments that add entries under CurrentVersion\Control Panel\CPLs, indicating a potential malicious Control Panel item persistence technique. It also looks for suspicious creation of entries related to .cpl execution, excluding common system or OEM-related paths when the process line matches known patterns. Telemetry required includes process creation events with Image, OriginalFileName, and CommandLine fields.
references:
  - https://ired.team/offensive-security/code-execution/code-execution-through-control-panel-add-ins
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_control_panel_item.yml
author: Kyaw Min Thein, Furkan Caliskan (@caliskanfurkan_), Huntrule Team
date: 2020-06-22
modified: 2023-10-11
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1218.002
  - attack.persistence
  - attack.t1546
logsource:
  product: windows
  category: process_creation
detection:
  selection_reg_img:
    - Image|endswith: \reg.exe
    - OriginalFileName: reg.exe
  selection_reg_cli:
    CommandLine|contains|all:
      - add
      - CurrentVersion\Control Panel\CPLs
  selection_cpl:
    CommandLine|endswith: .cpl
  filter_cpl_sys:
    CommandLine|contains:
      - \System32\
      - "%System%"
      - "|C:\\Windows\\system32|"
  filter_cpl_igfx:
    CommandLine|contains|all:
      - "regsvr32 "
      - " /s "
      - igfxCPL.cpl
  condition: all of selection_reg_* or (selection_cpl and not 1 of filter_cpl_*)
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 0ba863e6-def5-4e50-9cea-4dd8c7dc46a4
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL