CMSTP Execution Process Access via cmlua.dll

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

Detects process access events where the call trace contains 'cmlua.dll', which is indicative of Microsoft Connection Manager Profile Installer (CMSTP) execution. This activity can be abused by adversaries for code execution and UAC bypass.