Windows CMSTP Loads DLL/OCX from Suspicious Paths

Alerts when cmstp.exe loads DLL/OCX from suspicious directories on Windows.

FreeUnreviewedSigmahighv1

windows-cmstp-loads-dll-ocx-from-suspicious-paths-75e508f7

title: Windows CMSTP Loads DLL/OCX from Suspicious Paths
id: 5c244f40-58ad-4f2a-ab56-0031abbf088b
status: test
description: This rule flags executions where cmstp.exe loads a dynamic library (DLL) or ActiveX component (OCX) from commonly abused, non-standard locations. Attackers may use CMSTP as a signed proxy to load malicious code while blending into legitimate Windows workflows. The detection relies on image load telemetry capturing the loaded module path (ImageLoaded) and the launching process path (Image).
references:
  - https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/TTPs/Defense%20Evasion/T1218%20-%20Signed%20Binary%20Proxy%20Execution/T1218.003%20-%20CMSTP/Procedures.yaml
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_cmstp_load_dll_from_susp_location.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-30
modified: 2023-02-17
tags:
  - attack.stealth
  - attack.t1218.003
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith: \cmstp.exe
    ImageLoaded|contains:
      - \PerfLogs\
      - \ProgramData\
      - \Users\
      - \Windows\Temp\
      - C:\Temp\
    ImageLoaded|endswith:
      - .dll
      - .ocx
  condition: selection
falsepositives:
  - Unikely
level: high
license: DRL-1.1
related:
  - id: 75e508f7-932d-4ebc-af77-269237a84ce1
    type: derived

What it detects

This rule flags executions where cmstp.exe loads a dynamic library (DLL) or ActiveX component (OCX) from commonly abused, non-standard locations. Attackers may use CMSTP as a signed proxy to load malicious code while blending into legitimate Windows workflows. The detection relies on image load telemetry capturing the loaded module path (ImageLoaded) and the launching process path (Image).

Known false positives

Unikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.