{"id":"0ba863e6-def5-4e50-9cea-4dd8c7dc46a4","title":"Control Panel Items","description":"Detects the malicious use of a control panel item","author":"Kyaw Min Thein, Furkan Caliskan (@caliskanfurkan_)","status":"test","level":"high","date":"2020-06-22","modified":"2023-10-11","tags":["attack.privilege-escalation","attack.execution","attack.stealth","attack.t1218.002","attack.persistence","attack.t1546"],"technique_ids":["T1218.002","T1546"],"logsource":{"product":"windows","category":"process_creation"},"falsepositives":["Unknown"],"references":["https://ired.team/offensive-security/code-execution/code-execution-through-control-panel-add-ins"],"source_path":"rules/windows/process_creation/proc_creation_win_control_panel_item.yml","source_sha256":"1f82f3a61f2175cb5db931deff6fe461b91d9101c2373d6775612dcd0ef77fc6","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_control_panel_item.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Control Panel Items\nid: 0ba863e6-def5-4e50-9cea-4dd8c7dc46a4\nstatus: test\ndescription: Detects the malicious use of a control panel item\nreferences:\n    - https://ired.team/offensive-security/code-execution/code-execution-through-control-panel-add-ins\nauthor: Kyaw Min Thein, Furkan Caliskan (@caliskanfurkan_)\ndate: 2020-06-22\nmodified: 2023-10-11\ntags:\n    - attack.privilege-escalation\n    - attack.execution\n    - attack.stealth\n    - attack.t1218.002\n    - attack.persistence\n    - attack.t1546\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_reg_img:\n        - Image|endswith: '\\reg.exe'\n        - OriginalFileName: 'reg.exe'\n    selection_reg_cli:\n        CommandLine|contains|all:\n            - 'add'\n            - 'CurrentVersion\\Control Panel\\CPLs'\n    selection_cpl:\n        CommandLine|endswith: '.cpl'\n    filter_cpl_sys:\n        CommandLine|contains:\n            - '\\System32\\'\n            - '%System%'\n            - '|C:\\Windows\\system32|'\n    filter_cpl_igfx:\n        CommandLine|contains|all:\n            - 'regsvr32 '\n            - ' /s '\n            - 'igfxCPL.cpl'\n    condition: all of selection_reg_* or (selection_cpl and not 1 of filter_cpl_*)\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1218.002","id":"T1218.002","name":"Control Panel","page":"techniques/enterprise/T1218.002/"},{"key":"enterprise/T1546","id":"T1546","name":"Event Triggered Execution","page":"techniques/enterprise/T1546/"}],"data_path":"data/detection-rules/0ba863e6-def5-4e50-9cea-4dd8c7dc46a4.json","kind":"sigma"}