Windows Network Connections Initiated by cmstp.exe

title: Windows Network Connections Initiated by cmstp.exe
id: d21d2997-8082-4b46-8981-c69617b49523
status: test
description: This rule flags network connections where the process image ends with \cmstp.exe and the connection was initiated by that process. Because cmstp.exe rarely initiates outbound traffic in normal activity, such behavior can indicate abuse for stealthy execution or UAC bypass attempts. It relies on Windows network connection telemetry that includes the initiating process image path and the destination IP, excluding common local and reserved ranges.
references:
  - https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_cmstp_initiated_connection.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-30
modified: 2024-05-31
tags:
  - attack.stealth
  - attack.t1218.003
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: \cmstp.exe
    Initiated: "true"
  filter_main_local_ranges:
    DestinationIp|cidr:
      - 127.0.0.0/8
      - 10.0.0.0/8
      - 172.16.0.0/12
      - 192.168.0.0/16
      - 169.254.0.0/16
      - ::1/128
      - fe80::/10
      - fc00::/7
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: efafe0bf-4238-479e-af8f-797bd3490d2d
    type: derived