Control Panel Items

detection:
  filter_cpl_igfx:
    CommandLine|contains|all:
      - 'regsvr32 '
      - ' /s '
      - 'igfxCPL.cpl'
  filter_cpl_sys:
    CommandLine|contains:
      - '\System32\'
      - '%System%'
      - '|C:\Windows\system32|'
  selection_cpl:
    CommandLine|endswith: '.cpl'
  selection_reg_cli:
    CommandLine|contains|all:
      - 'add'
      - 'CurrentVersion\Control Panel\CPLs'
  selection_reg_img:
    - Image|endswith: '\reg.exe'
    - OriginalFileName: 'reg.exe'
  condition: all of selection_reg_* or (selection_cpl and not 1 of filter_cpl_*)

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Kyaw Min Thein, Furkan Caliskan (@caliskanfurkan_), under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.

The commands LOLBAS or GTFOBins documents for control.exe trip it too: each is on its program’s page, read by CmdID.