Windows Process Execution via WorkFolders.exe Launching control.exe

Alerts when WorkFolders.exe spawns a non-standard control.exe instance on Windows.

FreeUnreviewedSigmahighv1

windows-process-execution-via-workfolders-exe-launching-control-exe-0bbc6369

title: Windows Process Execution via WorkFolders.exe Launching control.exe
id: eb253c91-7f9b-4192-bae3-c68622164179
status: test
description: This rule flags process creation where WorkFolders.exe is the parent process and it spawns control.exe. An attacker could abuse this relationship to execute a system utility with a chosen control.exe instance, blending execution into legitimate Windows binaries. The detection relies on process creation telemetry, specifically parent and child process image paths, and matches when the child is a control.exe path that does not equal the standard C:\Windows\System32\control.exe.
references:
  - https://twitter.com/elliotkillick/status/1449812843772227588
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_workfolders.yml
author: Maxime Thiebaut (@0xThiebaut), Huntrule Team
date: 2021-10-21
modified: 2022-12-25
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \control.exe
    ParentImage|endswith: \WorkFolders.exe
  filter:
    Image: C:\Windows\System32\control.exe
  condition: selection and not filter
falsepositives:
  - Legitimate usage of the uncommon Windows Work Folders feature.
level: high
license: DRL-1.1
related:
  - id: 0bbc6369-43e3-453d-9944-cae58821c173
    type: derived

What it detects

This rule flags process creation where WorkFolders.exe is the parent process and it spawns control.exe. An attacker could abuse this relationship to execute a system utility with a chosen control.exe instance, blending execution into legitimate Windows binaries. The detection relies on process creation telemetry, specifically parent and child process image paths, and matches when the child is a control.exe path that does not equal the standard C:\Windows\System32\control.exe.

Known false positives

Legitimate usage of the uncommon Windows Work Folders feature.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.