Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
55 detections
Filters
Last updated
All Time
Detection languages
29
11
7
5
1
Contributors
17
11
9
5
3
Categories
35
20
5
4
4
Platforms
55
1
Products / Services
26
10
7
2
2
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
1
IDS Protocols
1
Detects execution of the Microsoft Connection Manager Profile Installer (cmstp.exe) with suspicious command-line parameters (using remote INF files via UNC or HTTP) or when it spawns unexpected child processes, both of which are indicative of potential bypass of User Account Control (UAC) or security controls.
Detects the execution of cmstp.exe with silent (/s) and auto-install (/au) flags pointing to an attacker-supplied INF file. This pattern is a documented technique for bypassing User Account Control (UAC) and performing signed-binary proxy execution to load malicious payloads.
This rule detects attempts to bypass Windows User Account Control (UAC) by identifying processes that use specific command-line arguments (such as /Elevation:Administrator, /shell:RunAs, or /runas /savecred) combined with known binaries (such as vsdbg, rundll32, or cmstp) often abused to achieve elevated privileges or proxy execution of malicious code.
Detects the execution of cmstp.exe with the /au parameter, which is commonly used to install malicious INF files, when initiated by LockAppHost.exe. This pattern is often indicative of an attempt to bypass application control or achieve privilege escalation by leveraging the legitimate Microsoft Connection Manager Profile Installer.
Detects the execution of cmstp.exe with the /au parameter, which is commonly used to install malicious INF files, when initiated by LockAppHost.exe. This pattern is often indicative of an attempt to bypass application control or achieve privilege escalation by leveraging the legitimate Microsoft Connection Manager Profile Installer.
Detects the execution of cmstp.exe with the /au parameter, which is commonly used to install malicious INF files, when initiated by LockAppHost.exe. This pattern is often indicative of an attempt to bypass application control or achieve privilege escalation by leveraging the legitimate Microsoft Connection Manager Profile Installer.
Detects the execution of cmstp.exe with the /au parameter, which is commonly used to install malicious INF files, when initiated by LockAppHost.exe. This pattern is often indicative of an attempt to bypass application control or achieve privilege escalation by leveraging the legitimate Microsoft Connection Manager Profile Installer.
Detects the execution of cmstp.exe with the /au parameter, which is commonly used to install malicious INF files, when initiated by LockAppHost.exe. This pattern is often indicative of an attempt to bypass application control or achieve privilege escalation by leveraging the legitimate Microsoft Connection Manager Profile Installer.
Detects various indicators of Microsoft Connection Manager Profile Installer execution
Detects execution of the Microsoft Connection Manager Profile Installer (cmstp.exe) when initialized with an INF file from potentially suspicious directories (e.g., Temp, AppData), or when cmstp.exe is observed spawning common command-line shells (cmd.exe, powershell.exe) or rundll32.exe, which is indicative of potential proxy execution or UAC bypass techniques.
Detects the execution of cmstp.exe with the '/s' flag, which indicates a silent installation. This behavior is often abused by adversaries to proxy execution of malicious code, bypass application control, or bypass User Account Control (UAC).
Detects the execution of cmstp.exe with the '/s' flag, which indicates a silent installation. This behavior is often abused by adversaries to proxy execution of malicious code, bypass application control, or bypass User Account Control (UAC).
Detects execution of the Microsoft Connection Manager Profile Installer (cmstp.exe) when initialized with an INF file from potentially suspicious directories (e.g., Temp, AppData), or when cmstp.exe is observed spawning common command-line shells (cmd.exe, powershell.exe) or rundll32.exe, which is indicative of potential proxy execution or UAC bypass techniques.
Detects execution of the Microsoft Connection Manager Profile Installer (cmstp.exe) when initialized with an INF file from potentially suspicious directories (e.g., Temp, AppData), or when cmstp.exe is observed spawning common command-line shells (cmd.exe, powershell.exe) or rundll32.exe, which is indicative of potential proxy execution or UAC bypass techniques.
Detects the use of cmstp.exe with suspicious command-line arguments (e.g., .inf file references or silent/unattended flags) often associated with bypass of application control or User Account Control (UAC).
Detects the use of cmstp.exe with suspicious command-line arguments (e.g., .inf file references or silent/unattended flags) often associated with bypass of application control or User Account Control (UAC).
Detects CMSTP used with INF files for UAC bypass and code execution
Detects the execution of cmstp.exe with the '/s' flag, which indicates a silent installation. This behavior is often abused by adversaries to proxy execution of malicious code, bypass application control, or bypass User Account Control (UAC).
This rule detects the delivery of a CMSTP INF file over HTTP that contains specific content indicative of a User Account Control (UAC) bypass attempt. It looks for HTTP responses containing a URI with ".inf", and within the file data, the strings "[DefaultInstall]" and "RegisterOCXs". This combination suggests an attempt to leverage CMSTP (Connection Manager Profile Installer) to execute arbitrary code, often used by adversaries for defense evasion and privilege escalation.
Detects the execution of cmstp.exe with the '/s' flag, which indicates a silent installation. This behavior is often abused by adversaries to proxy execution of malicious code, bypass application control, or bypass User Account Control (UAC).
Detects signed Windows binaries abused as execution proxies for defense evasion
Page 1 of 3