{"id":"2b140a5c-dc02-4bb8-b6b1-8bdb45714cde","title":"System Control Panel Item Loaded From Uncommon Location","description":"Detects image load events of system control panel items (.cpl) from uncommon or non-system locations that may indicate DLL sideloading or other abuse techniques.\n","author":"Anish Bogati","status":"test","level":"high","date":"2024-01-09","modified":"2026-02-17","tags":["attack.persistence","attack.privilege-escalation","attack.execution","attack.stealth","attack.t1574.001"],"technique_ids":["T1574.001"],"logsource":{"product":"windows","category":"image_load"},"falsepositives":["Unknown"],"references":["https://www.hexacorn.com/blog/2024/01/06/1-little-known-secret-of-fondue-exe/","https://www.hexacorn.com/blog/2024/01/01/1-little-known-secret-of-hdwwiz-exe/","https://github.com/mhaskar/FsquirtCPLPoC","https://securelist.com/sidewinder-apt/114089/"],"source_path":"rules/windows/image_load/image_load_side_load_cpl_from_non_system_location.yml","source_sha256":"41a5c173a9864b0b01c50f9309e9c1dc071f61edd431f2cef34e8b93b1ef6d74","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_side_load_cpl_from_non_system_location.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: System Control Panel Item Loaded From Uncommon Location\nid: 2b140a5c-dc02-4bb8-b6b1-8bdb45714cde\nstatus: test\ndescription: |\n    Detects image load events of system control panel items (.cpl) from uncommon or non-system locations that may indicate DLL sideloading or other abuse techniques.\nreferences:\n    - https://www.hexacorn.com/blog/2024/01/06/1-little-known-secret-of-fondue-exe/\n    - https://www.hexacorn.com/blog/2024/01/01/1-little-known-secret-of-hdwwiz-exe/\n    - https://github.com/mhaskar/FsquirtCPLPoC\n    - https://securelist.com/sidewinder-apt/114089/\nauthor: Anish Bogati\ndate: 2024-01-09\nmodified: 2026-02-17\ntags:\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.execution\n    - attack.stealth\n    - attack.t1574.001\nlogsource:\n    product: windows\n    category: image_load\ndetection:\n    selection:\n        ImageLoaded|endswith:\n            - '\\appwiz.cpl' # Usually loaded by fondue.exe\n            - '\\bthprops.cpl' # Usually loaded by fsquirt.exe\n            - '\\hdwwiz.cpl' # Usually loaded by hdwwiz.exe\n    filter_main_legit_location:\n        ImageLoaded|startswith:\n            - 'C:\\Windows\\Prefetch\\'\n            - 'C:\\Windows\\System32\\'\n            - 'C:\\Windows\\SysWOW64\\'\n            - 'C:\\Windows\\WinSxS\\'\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Unknown\nlevel: high\nregression_tests_path: regression_data/rules/windows/image_load/image_load_side_load_cpl_from_non_system_location/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1574.001","id":"T1574.001","name":"DLL","page":"techniques/enterprise/T1574.001/"}],"data_path":"data/detection-rules/2b140a5c-dc02-4bb8-b6b1-8bdb45714cde.json","kind":"sigma"}