T1218.002 System Binary Proxy Execution: Control Panel

Adversaries may abuse control.exe to proxy execution of malicious payloads. MITRE ATT&CK

1 program on CmdID 1 Sigma rule T1218.002 on attack.mitre.org

Part of

MITRE ATT&CK

T1218System Binary Proxy Execution

documented by LOLBAS and GTFOBins, or named by its rules

process creation, the highest levels first

highControl Panel ItemsKyaw Min Thein, Furkan Caliskan (@caliskanfurkan_) · Windows

everyday examples from tldr-pages, CC BY 4.0

Use a file name to open a control panel item on the page for Show-ControlPanelItem

appwiz.cplIdentify

An example is here when CmdID’s reading of it names T1218.002: a Sigma rule it trips is tagged with it, or its abuse is documented as it.