Windows CMSTP Process Creation Spawning Child Processes

Alerts on child processes spawned by Windows cmstp.exe, a common signal for CMSTP abuse.

FreeUnreviewedSigmahighv1

windows-cmstp-process-creation-spawning-child-processes-7d4cdc5a

title: Windows CMSTP Process Creation Spawning Child Processes
id: a621221b-4729-41be-8308-b9e68afec34a
status: stable
description: This rule flags Windows process creation events where the parent process is cmstp.exe. Attackers can abuse CMSTP via crafted configuration profiles to execute code and run additional child processes. The detection relies on process creation telemetry, specifically the ParentImage field ending with \cmstp.exe.
references:
  - https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmstp_execution_by_creation.yml
author: Nik Seetharaman, Huntrule Team
date: 2018-07-16
modified: 2020-12-23
tags:
  - attack.execution
  - attack.stealth
  - attack.t1218.003
  - attack.g0069
  - car.2019-04-001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \cmstp.exe
  condition: selection
falsepositives:
  - Legitimate CMSTP use (unlikely in modern enterprise environments)
level: high
license: DRL-1.1
related:
  - id: 7d4cdc5a-0076-40ca-aac8-f7e714570e47
    type: derived

What it detects

This rule flags Windows process creation events where the parent process is cmstp.exe. Attackers can abuse CMSTP via crafted configuration profiles to execute code and run additional child processes. The detection relies on process creation telemetry, specifically the ParentImage field ending with \cmstp.exe.

Known false positives

Legitimate CMSTP use (unlikely in modern enterprise environments)

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.