CMSTP Execution Process Creation

Title: CMSTP Execution Process Creation
Status: stable
Description:Detects various indicators of Microsoft Connection Manager Profile Installer execution
References:
  -https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/
Author: Nik Seetharaman
Date: 2018-07-16
modified:2020-12-23
Tags:

• -'attack.execution'
• -'attack.stealth'
• -'attack.t1218.003'
• -'attack.g0069'
• -'car.2019-04-001'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    ParentImage|endswith: '\cmstp.exe'
  condition:selection
Falsepositives:
  -Legitimate CMSTP use (unlikely in modern enterprise environments)
Level: high