CMSTP.exe Execution with INF File
Detects the execution of cmstp.exe with command-line arguments indicative of installing or registering components via an INF file. This behavior is often abused by adversaries for proxy execution, UAC bypass, or application control bypass.
Splunk (SPL)
