CMSTP App Paths Registry Key Modification

calendar Sep 1, 2026 · attack.execution attack.stealth attack.t1218.003 attack.g0069 car.2019-04-001  ·
Share on: linkedin copy

Detects modifications to the CMSTP App Paths registry key. This may indicate abuse of Microsoft Connection Manager Profile Installer (CMSTP) for arbitrary code execution or UAC bypass.

Sigma rule (View on GitHub)

 1title: CMSTP App Paths Registry Key Modification
 2id: b6d235fc-1d38-4b12-adbe-325f06728f37
 3status: stable
 4description: |
 5    Detects modifications to the CMSTP App Paths registry key. This may indicate abuse of
 6    Microsoft Connection Manager Profile Installer (CMSTP) for arbitrary code execution or UAC bypass.    
 7references:
 8    - https://lolbas-project.github.io/lolbas/Binaries/Cmstp/
 9    - https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/
10    - https://web.archive.org/web/20190722224110/https://oddvar.moe/2017/08/15/research-on-cmstp-exe/
11author: Nik Seetharaman
12date: 2018-07-16
13modified: 2026-08-27
14tags:
15    - attack.execution
16    - attack.stealth
17    - attack.t1218.003
18    - attack.g0069
19    - car.2019-04-001
20logsource:
21    category: registry_event
22    product: windows
23detection:
24    selection:
25        TargetObject|contains: 'SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\cmmgr32.exe\'
26    filter_main_cmcfg32:
27        TargetObject|endswith: 'SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\cmmgr32.exe\CmstpExtensionDll'
28        Details:
29            - 'C:\Windows\System32\cmcfg32.dll'
30            - 'C:\Windows\SysWOW64\cmcfg32.dll'
31    filter_main_empty:
32        Details: '(Empty)'
33    condition: selection and not 1 of filter_main_*
34falsepositives:
35    - Legitimate CMSTP use (unlikely in modern enterprise environments)
36level: high

References

Related rules

to-top