System Control Panel Item Loaded From Uncommon Location (2b140a5c-dc02-4bb8-b6b1-8bdb45714cde)
Detects image load events of system control panel items (.cpl) from uncommon or non-system locations which might be the result of sideloading.
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| System Control Panel Item Loaded From Uncommon Location (2b140a5c-dc02-4bb8-b6b1-8bdb45714cde) | Sigma-Rules | Masquerading - T1036 (42e8de7b-37b2-4258-905a-6897815e58e0) | Attack Pattern | 1 |