Outbound Network Connection Initiated By Cmstp.EXE
This rule detects outbound network connections initiated by the `cmstp.exe` process. `cmstp.exe` is the Microsoft Connection Manager Profile Installer, and it is uncommon for this legitimate binary to initiate outbound network connections. Such activity could indicate an adversary is abusing `cmstp.exe` to proxy execution of malicious code, potentially for defense evasion or UAC bypass, by loading malicious INF files or scriptlets from remote servers.
Sigma
