DLL Loaded From Suspicious Location Via Cmstp.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•21

Detects cmstp loading "dll" or "ocx" files from suspicious locations, which is a known technique for defense evasion and proxy execution. Adversaries can abuse CMSTP.exe, a legitimate Microsoft binary, to load and execute malicious DLLs or OCX files from non-standard directories, potentially bypassing application whitelisting and other security controls.