LoFP LoFP / legitimate cmstp use (unlikely in modern enterprise environments)

Techniques

Sample rules

CMSTP Execution Process Creation

Description

Detects various indicators of Microsoft Connection Manager Profile Installer execution

Detection logic

condition: selection
selection:
  ParentImage|endswith: \cmstp.exe

CMSTP UAC Bypass via COM Object Access

Description

Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects (e.g. UACMe ID of 41, 43, 58 or 65)

Detection logic

condition: selection
selection:
  IntegrityLevel:
  - High
  - System
  - S-1-16-16384
  - S-1-16-12288
  ParentCommandLine|contains:
  - ' /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}'
  - ' /Processid:{3E000D72-A845-4CD9-BD83-80C07C3B881F}'
  - ' /Processid:{BD54C901-076B-434E-B6C7-17C531F4AB41}'
  - ' /Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937}'
  - ' /Processid:{E9495B87-D950-4AB5-87A5-FF6D70BF3E90}'
  ParentImage|endswith: \DllHost.exe

CMSTP App Paths Registry Key Modification

Description

Detects modifications to the CMSTP App Paths registry key. This may indicate abuse of Microsoft Connection Manager Profile Installer (CMSTP) for arbitrary code execution or UAC bypass.

Detection logic

condition: selection and not 1 of filter_main_*
filter_main_cmcfg32:
  Details:
  - C:\Windows\System32\cmcfg32.dll
  - C:\Windows\SysWOW64\cmcfg32.dll
  TargetObject|endswith: SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\cmmgr32.exe\CmstpExtensionDll
filter_main_empty:
  Details: (Empty)
selection:
  TargetObject|contains: SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\cmmgr32.exe\

CMSTP Execution Process Access

Description

Detects various indicators of Microsoft Connection Manager Profile Installer execution

Detection logic

condition: selection
selection:
  CallTrace|contains: cmlua.dll