
title: CMSTP Execution Process Access
author: Nik Seetharaman
date: 2018/07/16
description: Detects various indicators of Microsoft Connection Manager Profile Installer
  execution
detection:
  SELECTION_1:
    EventID: 10
  SELECTION_2:
    CallTrace: '*cmlua.dll*'
  condition: (SELECTION_1 and SELECTION_2)
falsepositives:
- Legitimate CMSTP use (unlikely in modern enterprise environments)
fields:
- CommandLine
- ParentCommandLine
- Details
id: 3b4b232a-af90-427c-a22f-30b0c0837b95
level: high
logsource:
  category: process_access
  product: windows
modified: 2021/06/27
references:
- https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/
status: stable
tags:
- attack.defense_evasion
- attack.t1218.003
- attack.t1191
- attack.execution
- attack.t1559.001
- attack.t1175
- attack.g0069
- attack.g0080
- car.2019-04-001
ruletype: SIGMA
