Bypass UAC via CMSTP
Detects command-line usage of Microsoft Connection Manager Profile Installer (cmstp.exe) with specific flags often used to install specially formatted local .INF files for privilege escalation or defense evasion. This technique is commonly associated with UAC bypasses.
Sigma
