CMSTP profile installer executed on a Windows endpoint

Siemphony@siemphonyhighT1218.003verified in lab

Matches any process creation of `cmstp.exe`. The rule is deliberately shaped as an allow-list problem rather than a deny-list one: cmstp.exe accepts an installation information file from anywhere, so enumerating the suspicious locations an INF might sit in — %TEMP%, %APPDATA%, a UNC share, an HTTP URL — leaves C:\ProgramData\, C:\PerfLogs\, C:\Windows\Tasks\ and the profile root wide open, and staging the INF one directory to the side defeats the whole gate. Since cmstp.exe executes essentially never on an endpoint that is not having a Connection Manager profile deployed to it, matching the binary and then subtracting the estate's own rollout is both broader and quieter. That subtraction is what MITRE's INFPathRegex knob is for; it is left empty here because the known-good profile path and the installer parent are site-specific, and no value could be supplied that is correct anywhere but the site that wrote it. The expected baseline on a fleet that does not deploy Connection Manager profiles is zero events per year, so treat any hit as worth a look before reaching for tuning. Two limits. The COM path of this technique — instantiating the auto-elevated CMSTPLUA or CMLUAUTIL objects to bypass UAC, which the brief names in AN0932 and in its COMInterfaceGUIDs knob — never creates a cmstp.exe process at all, so it has no process-creation observable and a clean board here is not absence of CMSTP abuse. And the analytic's other halves, the follow-on Sysmon EventID 3 connection and the profile registry write, are a time-windowed correlation Sigma cannot express, so only the single-event precursor is authored here. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0328, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where FolderPath endswith "\\cmstp.exe"

Splunk · SPL

Run this as a search.

index=* Image="*\\cmstp.exe"

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE TO_LOWER(process.executable) LIKE "*\\\\cmstp.exe"

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\cmstp\.exe$</field>    <description>CMSTP profile installer executed on a Windows endpoint</description>    <mitre>      <id>T1218.003</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: high
Category: signed_binary_proxy
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 870f8b57-380a-4235-a58e-f8d65c25bc00

ATT&CKT1218.003

T1218.003CMSTP

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonsigned binary proxy

signed binary proxy

01 · What this rule detects

Attacker code executed through a Microsoft-signed utility so that the execution inherits a trusted signature and a familiar image name — rundll32, regsvr32, mshta, cmstp, msiexec, regasm and their relatives. The binary is legitimate and present on every Windows host; the arguments are what belongs to the attacker. This is worth catching because signature checks, allowlists and any rule that filters on 'signed by Microsoft' will pass it.

02 · Telemetry you need

Process creation with the complete, untruncated command line and the parent — Sysmon EventID 1, or Security 4688 with both Audit Process Creation and the command-line inclusion policy enabled; neither is on by default
Sysmon EventID 7 (ImageLoad) Image and ImageLoaded, to see which module a proxy binary actually loaded
Sysmon EventID 3 (NetworkConnect) tied to the same process id — these binaries fetching remote content is the loudest variant
Sysmon EventID 11 (FileCreate) for the scriptlet, DLL or MSI written just before execution
AppLocker or WDAC audit events (Microsoft-Windows-AppLocker EXE/DLL, MSI and Script logs) — present only where a policy is deployed, even in audit mode

03 · How the logic works

The image name alone is not a detection: rundll32 and msiexec run constantly on a healthy host. Every workable rule in this class is an AND between the image and the shape of its argument. The argument is where the signal lives — a URL or UNC path passed to regsvr32 or msiexec, a scriptlet extension, a protocol handler in an mshta argument, an INF file outside the VPN profile directories for cmstp, a DLL path under a user-writable directory, or rundll32 invoked with no arguments at all. Parentage is the second anchor and often the better one: these binaries launched by an Office application, a browser or a script host mean something quite different from the same binary launched by the installer service. Resist writing one rule per binary with a long keyword list — a rule per binary, anchored on that binary's specific abuse shape, stays readable and tunes independently.

04 · Common false positives

Software distribution running installers — SCCM, Intune and their msiexec invocations, including repair and reinstall
Printer, display and device drivers, which use rundll32 with printui.dll and similar entry points routinely
Control Panel applets and legacy shell handlers invoked through rundll32 by Explorer
Line-of-business applications still shipping HTA front ends, and vendor setup wrappers that call regsvr32 during registration
Genuine VPN client provisioning through cmstp, and .NET installers calling InstallUtil or RegAsm during deployment

05 · Detection maturity

Tier 1 — starting point: Matches known abuse strings in the command line of a handful of these binaries.
Tier 2 — tuned: Pairs each binary with its specific abuse shape and the parent process, excluding software distribution by signed path.
Tier 3 — correlated: Adds the loaded module, the file written immediately before, and whether that module has been seen anywhere else in the fleet.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Baseline the module and entry-point pairs your fleet actually uses for rundll32; the recurring ones are a short list and the outliers are the point of the rule
Alert first on the network-facing arguments — a remote path in the command line is the highest-payoff single condition in this category
Exclude on parent process and account together rather than on the argument, because the argument is the attacker's half
Match the argument case-insensitively and allow for quoting and extra whitespace; these command lines are assembled by hand
Where the telemetry has it, prefer the loaded-module event over the command line for rundll32 — it records what was really loaded rather than what was asked for

Declared by the author

Legitimate VPN and dial-up rollout, which is what CMSTP exists for. A helpdesk or software-distribution job installing the corporate profile fires once on every endpoint it touches, and on an estate that runs Connection Manager this is the only source that matters — pin the known-good INF path and the installer parent process through MITRE's INFPathRegex knob and suppress them.
A user installing a vendor-supplied connection profile they downloaded themselves, which is indistinguishable on the command line from a staged malicious one. Baseline by the INF's signing certificate or by its name before alerting.
Imaging and provisioning scripts that install a profile under SYSTEM during first boot. These are periodic and predictable, so carve them out by parent process and time of day.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification2 runs

Verified in Siemphony lab

Security Datasets — UAC bypassed through CMSTP profile installation
passed
Siemphony IR · 3 Sept 2026
1 true · 0 false · 0.0% noise
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1218.003, evaluated against their process_creation events.

Share this rule

/u/siemphony/870f8b57-380a-4235-a58e-f8d65c25bc00

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

CMSTP profile installer executed on a Windows endpoint

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it