Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
55 detections
Filters
Last updated
All Time
Detection languages
29
11
7
5
1
Contributors
17
11
9
5
3
Categories
35
20
5
4
4
Platforms
55
1
Products / Services
26
10
7
2
2
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
IDS Classtypes
1
IDS Protocols
1
Detects a network connection initiated by Cmstp.EXE
Its uncommon for "cmstp.exe" to initiate an outbound network connection. Investigate the source of such requests to determine if they are malicious.
Its uncommon for "cmstp.exe" to initiate an outbound network connection. Investigate the source of such requests to determine if they are malicious.
Detects cmstp loading "dll" or "ocx" files from suspicious locations
Detects various indicators of Microsoft Connection Manager Profile Installer execution
Detects various indicators of Microsoft Connection Manager Profile Installer execution
Bypass UAC via CMSTP
Sigma
Detect commandline usage of Microsoft Connection Manager Profile Installer (cmstp.exe) to install specially formatted local .INF files
Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects (e.g. UACMe ID of 41, 43, 58 or 65)
Detects network connections initiated by regsvr32.exe or cmstp.exe to external IP addresses on common web ports. This behavior can indicate the use of these legitimate Windows utilities for malicious purposes, such as downloading and executing malicious scripts or DLLs, often bypassing application whitelisting.
Detects the execution of cmstp.exe with command-line arguments indicative of installing or registering components via an INF file. This behavior is often abused by adversaries for proxy execution, UAC bypass, or application control bypass.
Detects a User Account Control (UAC) bypass attempt using the CMSTP COM interface. This specific rule looks for the process chain associated with the ValleyRAT campaign, where bypass.exe uses this technique to launch Nvidia.exe with elevated privileges.
This analytic detects network connections initiated by binaries that are not typically associated with network communication, such as 'notepad.exe', 'calc.exe' or 'write.exe'. It leverages Cisco Network Visibility Module logs to correlate network flow activity with process context, including command-line arguments, process path, and parent process information. These applications are normally used for locally and do not require outbound network access. When they do initiate such connections, it may indicate process hollowing, code injection, or proxy execution, where adversaries abuse a trusted process to mask malicious activity.
Detects the execution of the Microsoft Connection Manager Profile Installer (cmstp.exe) with command-line arguments that are commonly used to bypass User Account Control (UAC) and execute malicious INF files. This technique is leveraged by malware like Katz Stealer.
Bypass UAC via CMSTP
Sigma
Detect commandline usage of Microsoft Connection Manager Profile Installer (cmstp.exe) to install specially formatted local .INF files
Detects a network connection initiated by Cmstp.EXE
Its uncommon for "cmstp.exe" to initiate an outbound network connection. Investigate the source of such requests to determine if they are malicious.
Its uncommon for "cmstp.exe" to initiate an outbound network connection. Investigate the source of such requests to determine if they are malicious.
Bypass UAC via CMSTP
Sigma
Detect commandline usage of Microsoft Connection Manager Profile Installer (cmstp.exe) to install specially formatted local .INF files
Detects various indicators of Microsoft Connection Manager Profile Installer execution
Detects various indicators of Microsoft Connection Manager Profile Installer execution
Detects various indicators of Microsoft Connection Manager Profile Installer execution
Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects (e.g. UACMe ID of 41, 43, 58 or 65)
Detects various indicators of Microsoft Connection Manager Profile Installer execution
Detects various indicators of Microsoft Connection Manager Profile Installer execution
Detects cmstp loading "dll" or "ocx" files from suspicious locations
Page 2 of 3