Techniques
Sample rules
CMSTP Execution Process Creation
- source: sigma
- technicques:
- t1218
- t1218.003
Description
Detects various indicators of Microsoft Connection Manager Profile Installer execution
Detection logic
condition: selection
selection:
ParentImage|endswith: \cmstp.exe
CMSTP UAC Bypass via COM Object Access
- source: sigma
- technicques:
- t1218
- t1218.003
- t1548
- t1548.002
Description
Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects (e.g. UACMe ID of 41, 43, 58 or 65)
Detection logic
condition: selection
selection:
IntegrityLevel:
- High
- System
- S-1-16-16384
- S-1-16-12288
ParentCommandLine|contains:
- ' /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}'
- ' /Processid:{3E000D72-A845-4CD9-BD83-80C07C3B881F}'
- ' /Processid:{BD54C901-076B-434E-B6C7-17C531F4AB41}'
- ' /Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937}'
- ' /Processid:{E9495B87-D950-4AB5-87A5-FF6D70BF3E90}'
ParentImage|endswith: \DllHost.exe
CMSTP App Paths Registry Key Modification
- source: sigma
- technicques:
- t1218
- t1218.003
Description
Detects modifications to the CMSTP App Paths registry key. This may indicate abuse of Microsoft Connection Manager Profile Installer (CMSTP) for arbitrary code execution or UAC bypass.
Detection logic
condition: selection and not 1 of filter_main_*
filter_main_cmcfg32:
Details:
- C:\Windows\System32\cmcfg32.dll
- C:\Windows\SysWOW64\cmcfg32.dll
TargetObject|endswith: SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\cmmgr32.exe\CmstpExtensionDll
filter_main_empty:
Details: (Empty)
selection:
TargetObject|contains: SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\cmmgr32.exe\
CMSTP Execution Process Access
- source: sigma
- technicques:
- t1218
- t1218.003
- t1559
- t1559.001
Description
Detects various indicators of Microsoft Connection Manager Profile Installer execution
Detection logic
condition: selection
selection:
CallTrace|contains: cmlua.dll