Compliance Node Overview
MITRE ATT&CK T1218.002 (Control Panel) is an Enterprise Defense Evasion sub-technique of T1218 (System Binary Proxy Execution). Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings. Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet function. Affected platforms: Windows. MITRE-documented mitigations include M1022 Restrict File and Directory Permissions, M1038 Execution Prevention. The Center for Threat-Informed Defense maps this technique to NIST SP 800-53 Rev 5 controls AC-02, AC-03, AC-04, AC-05, AC-06, CA-07, CM-02, CM-05.
Pillar: Cybersecurity · Authority: MITRE Corporation · Version: 1.0.0 · Last updated:
Primary source: https://attack.mitre.org/techniques/T1218/002/
SHA-256 integrity: 6b9af901fa60636d8ee905605b78a5dfb668e80c5c3515a70f367a7ba66fa693
Primary Citations — 7 traced to source
- MITRE ATT&CK Technique T1218.002: Control Panel (https://attack.mitre.org/techniques/T1218/002/)
- MITRE ATT&CK Tactic TA0005: Defense Evasion (https://attack.mitre.org/tactics/TA0005/)
+ 5 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access