control.exe

Windows Control Panel file version info (xCyclopedia)

LOLBAS ADS, Execute 4 Sigma rules name it 1 ATT&CK technique 2 documented commands 14 known copies with hashes

How control.exe is abused

documented by LOLBAS

ADS T1218.002 System Binary Proxy Execution: Control Panel

Execute T1218.002 System Binary Proxy Execution: Control Panel

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for control.exe.

2 documented commands

from LOLBAS, each read by the identifier

ADS T1218.002 System Binary Proxy Execution: Control Panel User privileges

Execute evil.dll which is stored in an Alternate Data Stream (ADS).

control.exe {PATH_ABSOLUTE}:evil.dll

Identify

Trips no Sigma process-creation rule.

Execute T1218.002 System Binary Proxy Execution: Control Panel User privileges

Execute .cpl file. A CPL is a DLL file with CPlApplet export function)

control.exe {PATH_ABSOLUTE:.cpl}

Identify

Trips 1 Sigma rule: highControl Panel Items by Kyaw Min Thein, Furkan Caliskan (@caliskanfurkan_)

1 of the 2 commands the identifier reads trips a Sigma process-creation rule; 1 trips none. These commands and their descriptions are from LOLBAS’s entry for control.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for control.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

highPotential CVE-2021-40444 Exploitation AttemptFlorian Roth (Nextron Systems), @neonprimetime

highSuspicious Microsoft OneNote Child ProcessTim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea)

highSuspicious Microsoft Office Child ProcessFlorian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io

highExecution via WorkFolders.exeMaxime Thiebaut (@0xThiebaut)

T1218.002System Binary Proxy Execution: Control Panel

Is it the real control.exe?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionWindows Control Panel

14 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\control.exe · signed by Microsoft Windows

1317e60c089b4ce47a3ecd00cce646644f50db11d52d07f229c097ffff26b597

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\control.exe · signed by Microsoft Windows

fecc2504b781d79224d9e40069a3a8f87e654d04f11ebd5ac4f478ce7b7326b0

10.0.19041.423 (WinBuild.160101.0800) · C:\Windows\system32\control.exe · signed by Microsoft Windows

54d9f98f36bc5511d281318b8022002f74ad30b6383696e861220e15ee68e5a3

10.0.19041.423 (WinBuild.160101.0800) · C:\Windows\SysWOW64\control.exe · signed by Microsoft Windows

d923f812bf0191f3344de6cd5fceaf6c7b2f6961f637c74c2aa329fb3f8ca6c5

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\control.exe · signed by Microsoft Windows

398a51e3d0b818f8b7d4d0349d97821d68bcf98c6760a3062528b4b7b43f2b1d

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\control.exe · signed by Microsoft Windows

b631d48964a6960fd326d1288163882ddb385ee9e9324ed6415237499361499b

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\control.exe · signed by Microsoft Windows

d494605a89952cffbaa36c781f7ddd4a0d9c41350c5bc7b4ccbb5ba95d0da949

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\control.exe · signed by Microsoft Windows

d6e21da3be0701162a36f8c9f94e616b1a0c5fd4cc1b52efd81959cb257957c1

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\control.exe · signed by Microsoft Windows

4774a931c9d97828323c9e829917d82c27a05dab9fea6a0cef9ebba59942231f

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\control.exe · signed by Microsoft Windows

cf19eaff8ae1d6a4ab70a2e2ce996f49d3afdc193ee8f69aef881e5727bc8f38

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\control.exe · signed by Microsoft Windows

76d741c6fedc2426483ebee82aed4193f1dffec531154bc5ead024be1119a564

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\control.exe · signed by Microsoft Windows

cb089c50698bee280244437bcaf56d3955402a582e5e928dbc8812a5d9c0ef4d

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\SysWOW64\control.exe · not signed

088b7693be0643277d16a66862b4446a288afb86b2e987fe7a943126d0dd08f0

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\control.exe · not signed

b3705873c8ccf1a5ef93318327e56374216536a0697f6517fe28560131965e6e

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.