Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1218.002_control-panel
Adversaries may abuse control.exe to proxy execution of malicious payloads.
Passed 21 of 23 test cases with the skill, and 19 of 23 without it.
and 1 more in the full report
3 fixed18 passed either way1 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
During a threat coverage audit for T1218.002, how many distinct MITRE mitigations are formally defined in the baseline assessment checklist for Control Panel security posture?
| Checked | Without skill | With skill |
|---|---|---|
| States that exactly 2 mitigations are defined. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1218
Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings.
Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet function. For ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel. Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file.
Malicious Control Panel items can be delivered via Phishing campaigns or executed as part of multi-stage malware. Control Panel items, specifically CPL files, may also bypass application and/or file extension allow lists.
Adversaries may also rename malicious DLL files (.dll) with Control Panel file extensions (.cpl) and register them to HKCU\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls. Even when these registered DLLs do not comply with the CPL file specification and do not export CPlApplet functions, they are loaded and executed through its DllEntryPoint when Control Panel is executed. CPL files not exporting CPlApplet are not directly executable.
Platforms: Windows
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
This test simulates an adversary leveraging control.exe Upon execution calc.exe will be launched
Supported Platforms: windows
test cases passed, vs 19 / 23 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.