CMSTP Spawning Child Process
This rule detects the creation of child processes by 'cmstp.exe', the Microsoft Connection Manager Profile Installer. Adversaries often abuse cmstp.exe to proxy execution of malicious code, bypass User Account Control (UAC), or evade application control defenses by loading and executing DLLs or COM scriptlets. This detection specifically looks for any process that has 'cmstp.exe' as its direct parent.
Sigma
