Cmstp Making Network Connection
Detects suspicious network connection by Cmstp
Sigma rule (View on GitHub)
1title: Cmstp Making Network Connection
2id: efafe0bf-4238-479e-af8f-797bd3490d2d
3status: test
4description: Detects suspicious network connection by Cmstp
5references:
6 - https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/
7author: Nasreddine Bencherchali (Nextron Systems)
8date: 2022/08/30
9tags:
10 - attack.defense_evasion
11 - attack.t1218.003
12logsource:
13 category: network_connection
14 product: windows
15detection:
16 selection:
17 Image|endswith: '\cmstp.exe'
18 Initiated: 'true'
19 condition: selection
20falsepositives:
21 - Unknown
22level: high
References
Related rules
- CMSTP UAC Bypass via COM Object Access
- Bypass UAC via CMSTP
- CMSTP Execution Process Creation
- CMSTP Execution Registry Event
- AMSI Bypass Pattern Assembly GetType