LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Control.exe

View source

Binary used to launch controlpanel items in Windows

ADSExecute
02COMMAND EXAMPLES
01ATT&CK TECHNIQUES
05DETECTION RESOURCES
02CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

ADS1

EXAMPLE 01T1218.002

Execute evil.dll which is stored in an Alternate Data Stream (ADS).

COMMAND
control.exe {PATH_ABSOLUTE}:evil.dll
USE CASE
Can be used to evade defensive countermeasures or to hide as a persistence mechanism
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · DLL

Execute1

EXAMPLE 01T1218.002

Execute .cpl file. A CPL is a DLL file with CPlApplet export function)

COMMAND
control.exe {PATH_ABSOLUTE:.cpl}
USE CASE
Use to execute code and bypass application whitelisting
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · DLL
02 / ON DISK

Known paths

C:\Windows\System32\control.exe
C:\Windows\SysWOW64\control.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

5 resources

Indicators & detection notes

  • IOC

    Control.exe executing files from alternate data streams

  • IOC

    Control.exe executing library file without cpl extension

  • IOC

    Suspicious network connections from control.exe

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Jimmy@bohops