Query: Sigma rule for Detects image load events of system control panel items (.cpl) from uncommon or non-system locations that may indicate D
Matching passage: Sigma rule: Detects image load events of system control panel items (.cpl) from uncommon or non-system locations that may indicate D. Logsource: windows / image_load. Rule: title: System Control Panel Item Loaded From Uncommon Location id: 2b140a5c-dc02-4bb8-b6b1-8bdb45714cde status: test description: 'Detects image load events of system control panel items (.cpl) from uncommon or non-system locations that may indicate DLL sideloading or other abuse techniques. ' references: - https://www.hexacorn.com/blog/2024/01/06/1-little-known-secret-of-fondue-exe/ - https://www.hexacorn.com/blog/2024/01/01/1-little-known-secret-of-hdwwiz-exe/ - https://github.com/mhaskar/FsquirtCPLPoC - https://securelist.com/sidewinder-apt/114089/ author: Anish Bogati date: 2024-01-09 modified: 2026-02-17 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: product: windows category: image_load detection: selection: ImageLoaded|endswith: - \appwiz.cpl - \bthprops.cpl - \hdwwiz.cpl filter_main_legit_location: ImageLoaded|startswith: - C:\Windows\Prefetch\ - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/image_load/image_load_side_load_cpl_from_non_system_location/info.yml
Near-miss passage: Sigma rule: Detects modification of autostart extensibility point (ASEP) in registry. Adversaries may modify these keys to execute m. Logsource: windows / registry_set. Rule: title: Office Autorun Keys Modification id: baecf8fb-edbf-429f-9ade-31fc3f22b970 related: - id: 17f878b8-9968-4578-b814-c4217fc5768c type: obsolete status: test description: 'Detects modification of autostart extensibility point (ASEP) in registry. Adversaries may modify these keys to execute malicious code when Office files are opened. There are various legitimate add-ins that also use these keys and this filter list might not be exhaustive. Thus, it is recommended to review and tune filters for your environment to reduce false positives before deploying to production. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) date: 2019-10-25 modified: 2026-01-09 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_set product: windows detection: selection_office_root: TargetObject|contains: - \Software\Wow6432Node\Microsoft\Office - \Software\Microsoft\Office selection_office_details: TargetObject|contains: - \Word\Addins - \PowerPoint\Addins - \Outlook\Addins - \Onenote\Addins - \Excel\Addins - \Access\Addins - test\Special\Perf filter_main_empty: Details: (Empty) filter_main_null: Details: null filter_main_known_addins: Image|startswith: - C:\Program Files\Microsoft Office\ - C:\Program Files (x86)\Microsoft Office\ - C:\PROGRA~2\MICROS~2\Office - C:\Windows\System32\msiexec.exe - C:\Windows\SysWOW64\msiexec.exe - C:\Windows\System32\regsvr32.exe - 'C:\Windows\SysWOW64\regsvr32.exe ' TargetObject|contains: - \Excel\Addins\AdHocReportingExcelClientLib.AdHocReportingExcelClientAddIn.1\ - \Excel\Addins\ExcelPlugInShell.PowerMapConnect\ - \Excel\Addins\NativeShim\ - \Excel\Addins\NativeShim.InquireConnector.1\ - \Excel\Addins\PowerPivotExcelClientAddIn.NativeEntry.1\ - \Outlook\AddIns\AccessAddin.DC\ - \Outlook\AddIns\ColleagueImport.ColleagueImportAddin\ - \Outlook\AddIns\EvernoteCC.EvernoteContactConnector\ - \Outlook\AddIns\EvernoteOLRD.Connect\ - \Outlook\Addins\\OneNote.OutlookAddin - \Outlook\Addins\DriveFSExtensionLib.Connect\ - \Outlook\Addins\GoogleAppsSync.Connect\ - \Outlook\Addins\Microsoft.VbaAddinForOutlook.1\ - \Outlook\Addins\OcOffice.OcFo