Detectionhighstable

CMSTP Execution Process Creation

Detects various indicators of Microsoft Connection Manager Profile Installer execution

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Nik SeetharamanCreated Mon Jul 16Updated Wed Dec 237d4cdc5a-0076-40ca-aac8-f7e714570e47windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    # CMSTP Spawning Child Process
    selection:
        ParentImage|endswith: '\cmstp.exe'
    condition: selection

False Positives

Legitimate CMSTP use (unlikely in modern enterprise environments)

References

MITRE ATT&CK

Tactics

Sub-techniques

Groups

CAR Analytics

2019-04-001 · CAR 2019-04-001

Rule Metadata

Rule ID

7d4cdc5a-0076-40ca-aac8-f7e714570e47

Status

stable

Level

high

Type

Detection

Created

Mon Jul 16

Modified

Wed Dec 23

Author

Path

rules/windows/process_creation/proc_creation_win_cmstp_execution_by_creation.yml

Raw Tags

attack.defense-evasionattack.executionattack.t1218.003attack.g0069car.2019-04-001