Control Panel Process with Unusual Arguments

  1[metadata]
  2creation_date = "2021/09/08"
  3integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies unusual instances of Control Panel with suspicious keywords or paths in the process command line value.
 11Adversaries may abuse control.exe to proxy execution of malicious code.
 12"""
 13from = "now-9m"
 14index = [
 15    "endgame-*",
 16    "logs-crowdstrike.fdr*",
 17    "logs-endpoint.events.process-*",
 18    "logs-m365_defender.event-*",
 19    "logs-sentinel_one_cloud_funnel.*",
 20    "logs-system.security*",
 21    "logs-windows.forwarded*",
 22    "logs-windows.sysmon_operational-*",
 23    "winlogbeat-*",
 24]
 25language = "eql"
 26license = "Elastic License v2"
 27name = "Control Panel Process with Unusual Arguments"
 28references = ["https://www.joesandbox.com/analysis/476188/1/html"]
 29risk_score = 73
 30rule_id = "416697ae-e468-4093-a93d-59661fa619ec"
 31severity = "high"
 32tags = [
 33    "Domain: Endpoint",
 34    "OS: Windows",
 35    "Use Case: Threat Detection",
 36    "Tactic: Defense Evasion",
 37    "Data Source: Elastic Endgame",
 38    "Data Source: Elastic Defend",
 39    "Data Source: Windows Security Event Logs",
 40    "Data Source: Microsoft Defender XDR",
 41    "Data Source: Sysmon",
 42    "Data Source: SentinelOne",
 43    "Data Source: Crowdstrike",
 44    "Resources: Investigation Guide",
 45    "Noise: Medium",
 46    "Performance: Normal",
 47    "Profile: Recommended",
 48    "Threat: Living off the Land",
 49    "Rule Type: Event Correlation (EQL)",
 50    "Platform: Windows",
 51]
 52timestamp_override = "event.ingested"
 53type = "eql"
 54
 55query = '''
 56process where host.os.type == "windows" and event.type == "start" and
 57  process.name : "control.exe" and
 58  process.command_line : (
 59    "*.jpg*", "*.png*",
 60    "*.gif*", "*.bmp*",
 61    "*.jpeg*", "*.TIFF*",
 62    "*.inf*", "*.cpl:*/*",
 63    "*../../..*",
 64    "*/AppData/Local/*",
 65    "*:\\Users\\Public\\*",
 66    "*\\AppData\\Local\\*"
 67)
 68'''
 69
 70note = """## Triage and analysis
 71
 72### Investigating Control Panel Process with Unusual Arguments
 73
 74#### Possible investigation steps
 75
 76- Which suspicious argument family did the alert preserve, and what does it imply?
 77  - Focus: `process.command_line` and `@timestamp`, identifying image or INF targets, ".cpl:" indirection, traversal (".."), "AppData\\Local", or "Users\\Public" fragments.
 78  - Implication: escalate when Control Panel points at non-applet content, user-writable paths, traversal, or URL-like ".cpl:" loading; lower suspicion only when the path and argument resolve to one recognized vendor applet, driver package, or support workflow.
 79
 80- Is the alerting binary really the expected Control Panel executable?
 81  - Focus: `process.executable`, `process.pe.original_file_name`, `process.code_signature.subject_name`, `process.code_signature.trusted`, and `process.hash.sha256`.
 82  - Implication: escalate if "control.exe" is renamed, unsigned or untrusted, has an unfamiliar hash, or runs outside the Windows system path; Microsoft identity lowers masquerade risk but does not clear the arguments.
 83
 84- Does the parent and user context fit this launch?
 85  - Focus: `process.parent.executable`, `process.parent.command_line`, `user.id`, and `user.name`.
 86  - Implication: Office, browser, script-host, archive-tool, remote-admin, or mismatched-user launches make the command abnormal; keep validating only when parent and user context fit the applet, driver, support, or lab workflow named by the command line.
 87
 88- Did Control Panel hand off to follow-on execution?
 89  - Focus: child starts on the same `host.id` where `process.parent.entity_id` equals the alert `process.entity_id`; review child `process.executable`, `process.command_line`, and `process.pe.original_file_name`. $investigate_0
 90  - Implication: follow-on execution confirms proxy-abuse risk when the chain uses "rundll32.exe" or "Control_RunDLL", or spawns PowerShell, cmd, mshta, regsvr32, wscript, cscript, or another unexpected LOLBin; a clean stop at the expected applet or support component narrows scope.
 91  - Hint: if `process.entity_id` is absent, recover children with `host.id` + `process.pid` near `@timestamp`; treat ambiguity as unresolved.
 92
 93- Did the referenced path contain staged or renamed payload content?
 94  - Focus: file events for `host.id` + `process.entity_id`, or `host.id` + `process.pid` near `@timestamp`; review `file.path`, `file.Ext.original.path`, `file.Ext.header_bytes`, and `file.Ext.windows.zone_identifier`. $investigate_1
 95  - Implication: escalate when file events show executable or script content, mismatched headers, recent renames, internet provenance, or payloads under "AppData\\Local" or "Users\\Public"; artifacts confined to the same recognized vendor package layout reduce file concern. Missing file telemetry is unresolved, not benign.
 96
 97- Did the process or host contact delivery or command-and-control infrastructure?
 98  - Focus: DNS and connection events for `host.id` + `process.entity_id`, or `host.id` + `process.pid` near `@timestamp`; compare DNS `dns.question.name` and `dns.resolved_ip` with `destination.ip` and `destination.port`. $investigate_2
 99  - Implication: escalate when network events show the same process or host reaching rare external domains, payload hosts, or mismatched service ports after launch; urgency drops only when traffic stays limited to the same recognized vendor or internal service. Missing network telemetry is unresolved, not benign.
100  - Hint: separate DNS events from connection events before correlating `dns.resolved_ip` to `destination.ip`.
101
102- If local evidence is suspicious or unresolved, does related alert activity change the user or host scope?
103  - Focus: alerts for the same `user.id` showing delivery, persistence, defense evasion, suspicious children, or other proxy-execution utilities such as "rundll32.exe", "mshta.exe", or "regsvr32.exe". $investigate_3
104  - Hint: use the host pivot separately for the same patterns on `host.id`, especially when user context is absent or shared. $investigate_4
105  - Implication: broaden scope when either pivot shows related delivery, persistence, proxy execution, or repeated suspicious Control Panel launches; keep local only when local evidence is explained and related alerts do not contradict it.
106
107- Escalate when command intent plus any meaningful corroborator indicates proxy execution, staged payloads, unexpected child execution, suspicious destinations, or spread; close only when alert-local process evidence and supported recovery bind the exact activity to one recognized workflow with no contradictions; if evidence is mixed or visibility is incomplete, preserve artifacts and escalate.
108
109### False positive analysis
110
111- Vendor applets, printer/display drivers, hardware-management packages, support troubleshooting, or lab validation can trigger unusual Control Panel paths. Confirm `process.command_line` names the expected CPL or INF target, `process.executable` is the Microsoft system binary, `process.parent.executable` and `process.parent.command_line` match the installer or support component, `user.id` and `host.id` fit the endpoint or lab cohort, artifacts stay inside the vendor package layout, and no suspicious child process or unexpected external destination follows. Use package, change, or lab records only as corroboration; without them, close only when this case's telemetry binds the exact workflow. Treat it as a candidate exception until records or recurrence confirm stability.
112- Before creating an exception, validate that the same `process.executable`, `process.parent.executable`, stable `process.command_line` pattern, `user.id`, and `host.id` recur across prior alerts from this rule. Build the exception from that minimum confirmed workflow pattern. Avoid exceptions on "control.exe" alone, on a file extension alone, or on a host alone.
113
114### Response and remediation
115
116- If confirmed benign, reverse any temporary containment and document the command, binary identity, parent workflow, account, host, artifact, and destination evidence that proved one recognized workflow. Create an exception only if that same workflow recurs across prior alerts from this rule.
117- If suspicious but unconfirmed, preserve a case export with `process.command_line`, `process.entity_id`, parent and child lineage, referenced artifacts, and network indicators when available before containment. Apply reversible containment first, such as temporary egress restrictions or heightened monitoring on the affected `host.id` and `user.id`, and avoid deleting files or killing child processes until follow-on execution is scoped.
118- Do not isolate or suspend based on the alert alone. Escalate suspicious-but-unconfirmed cases to host isolation or account action only when child-process, artifact, network, or related-alert evidence shows likely follow-on execution or broader exposure.
119- If confirmed malicious, preserve the same process, artifact, and network evidence before destructive action. Isolate the endpoint to stop further execution while keeping telemetry available; if direct endpoint response is unavailable, hand off the preserved `host.id`, `user.id`, `process.entity_id`, and command-line evidence to the team that can isolate the host or suspend the account.
120- After scoping related hosts, users, parent processes, command-line fragments, referenced paths, and follow-on children, quarantine or remove the malicious applets, DLLs, scripts, archives, or dropped artifacts identified during the investigation. Restore affected Control Panel or shell-association paths to the expected baseline and verify no persistence remains.
121- Post-incident hardening: restrict document-, script-, and archive-driven launches of Control Panel on privileged or shared systems, retain any file or network telemetry that limited the case, and record the confirmed workflow or malicious artifact pattern for future triage.
122"""
123
124setup = """## Setup
125
126This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
127
128Setup instructions: https://ela.st/install-elastic-defend
129
130### Additional data sources
131
132This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
133
134- [CrowdStrike](https://ela.st/crowdstrike-integration)
135- [Microsoft Defender XDR](https://ela.st/m365-defender)
136- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
137- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
138- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
139"""
140
141[rule.investigation_fields]
142field_names = [
143    "@timestamp",
144    "host.name",
145    "host.id",
146    "user.name",
147    "user.id",
148    "process.entity_id",
149    "process.pid",
150    "process.executable",
151    "process.command_line",
152    "process.working_directory",
153    "process.pe.original_file_name",
154    "process.parent.entity_id",
155    "process.parent.name",
156    "process.parent.executable",
157    "process.parent.command_line",
158]
159
160[transform]
161
162[[transform.investigate]]
163label = "Child process events for Control Panel"
164description = ""
165providers = [
166  [
167    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
168    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
169    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" }
170  ]
171]
172relativeFrom = "now-1h"
173relativeTo = "now"
174
175[[transform.investigate]]
176label = "File events for Control Panel"
177description = ""
178providers = [
179  [
180    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
181    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
182    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" }
183  ]
184]
185relativeFrom = "now-1h"
186relativeTo = "now"
187
188[[transform.investigate]]
189label = "Network events for Control Panel"
190description = ""
191providers = [
192  [
193    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
194    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
195    { excluded = false, field = "event.category", queryType = "phrase", value = "network", valueType = "string" }
196  ],
197  [
198    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
199    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
200    { excluded = false, field = "event.category", queryType = "phrase", value = "dns", valueType = "string" }
201  ]
202]
203relativeFrom = "now-1h"
204relativeTo = "now"
205
206[[transform.investigate]]
207label = "Alerts associated with the user"
208description = ""
209providers = [
210  [
211    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
212    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" }
213  ]
214]
215relativeFrom = "now-48h/h"
216relativeTo = "now"
217
218[[transform.investigate]]
219label = "Alerts associated with the host"
220description = ""
221providers = [
222  [
223    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
224    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
225  ]
226]
227relativeFrom = "now-48h/h"
228relativeTo = "now"
229
230[[rule.threat]]
231framework = "MITRE ATT&CK"
232[[rule.threat.technique]]
233id = "T1218"
234name = "System Binary Proxy Execution"
235reference = "https://attack.mitre.org/techniques/T1218/"
236[[rule.threat.technique.subtechnique]]
237id = "T1218.002"
238name = "Control Panel"
239reference = "https://attack.mitre.org/techniques/T1218/002/"
240
241[rule.threat.tactic]
242id = "TA0005"
243name = "Defense Evasion"
244reference = "https://attack.mitre.org/tactics/TA0005/"