Control Panel Process with Unusual Arguments

Identifies unusual instances of Control Panel with suspicious keywords or paths in the process command line value. Adversaries may abuse control.exe to proxy execution of malicious code.

Elastic rule (View on GitHub)

 1[metadata]
 2creation_date = "2021/09/08"
 3integration = ["endpoint", "windows", "system"]
 4maturity = "production"
 5min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 6min_stack_version = "8.3.0"
 7updated_date = "2024/01/16"
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Identifies unusual instances of Control Panel with suspicious keywords or paths in the process command line value.
13Adversaries may abuse control.exe to proxy execution of malicious code.
14"""
15from = "now-9m"
16index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
17language = "eql"
18license = "Elastic License v2"
19name = "Control Panel Process with Unusual Arguments"
20references = ["https://www.joesandbox.com/analysis/476188/1/html"]
21risk_score = 73
22rule_id = "416697ae-e468-4093-a93d-59661fa619ec"
23setup = """
24
25If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
26events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
27Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
28`event.ingested` to @timestamp.
29For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
30"""
31severity = "high"
32tags = ["Domain: Endpoint",
33        "OS: Windows",
34        "Use Case: Threat Detection",
35        "Tactic: Defense Evasion",
36        "Tactic: Execution",
37        "Data Source: Elastic Endgame", 
38        "Data Source: Elastic Defend"
39        ]
40timestamp_override = "event.ingested"
41type = "eql"
42
43query = '''
44process where host.os.type == "windows" and event.type == "start" and
45 process.executable : ("?:\\Windows\\SysWOW64\\control.exe", "?:\\Windows\\System32\\control.exe") and
46 process.command_line :
47          ("*.jpg*",
48           "*.png*",
49           "*.gif*",
50           "*.bmp*",
51           "*.jpeg*",
52           "*.TIFF*",
53           "*.inf*",
54           "*.cpl:*/*",
55           "*../../..*",
56           "*/AppData/Local/*",
57           "*:\\Users\\Public\\*",
58           "*\\AppData\\Local\\*")
59'''
60
61
62[[rule.threat]]
63framework = "MITRE ATT&CK"
64[[rule.threat.technique]]
65id = "T1218"
66name = "System Binary Proxy Execution"
67reference = "https://attack.mitre.org/techniques/T1218/"
68[[rule.threat.technique.subtechnique]]
69id = "T1218.002"
70name = "Control Panel"
71reference = "https://attack.mitre.org/techniques/T1218/002/"
72
73
74
75[rule.threat.tactic]
76id = "TA0005"
77name = "Defense Evasion"
78reference = "https://attack.mitre.org/tactics/TA0005/"

References

Related rules

to-top