CMSTP Execution Registry Event
Detects the execution of Microsoft Connection Manager Profile Installer (CMSTP.exe) by monitoring registry events where 'cmmgr32.exe' is the target object. This activity is often associated with defense evasion and execution techniques, as CMSTP can be abused to proxy execution of malicious code, bypass UAC, or load DLLs/COM scriptlets.
Sigma
