Control Panel Items

Windows Control Panel items are utilities that allow users to view and adjust computer settings. Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet function. ^{1 2} Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file. ^{3 4 5} For ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel. ⁶ Adversaries can use Control Panel items as execution payloads to execute arbitrary commands. Malicious Control Panel items can be delivered via Spearphishing Attachment campaigns ^{7 8} or executed as part of multi-stage malware. ⁹ Control Panel items, specifically CPL files, may also bypass application and/or file extension whitelisting.

1. Microsoft Implementing CPL
2. TrendMicro CPL Malware Jan 2014
3. Microsoft Implementing CPL
4. TrendMicro CPL Malware Jan 2014
5. TrendMicro CPL Malware Dec 2013
6. Microsoft Implementing CPL
7. TrendMicro CPL Malware Jan 2014
8. TrendMicro CPL Malware Dec 2013
9. Palo Alto Reaver Nov 2017

使用该技术的组织

参考表中尚无组织使用记录。

断言

尚无指向该技术的公开断言。

记录自动入库·未人工复核；置信度与有效期按引用读取。