Windows Process Access Involving cmlua.dll During CMSTP Execution

title: Windows Process Access Involving cmlua.dll During CMSTP Execution
id: ae268f52-a2ea-4915-af6d-6515678beffa
status: stable
description: This rule flags Windows process access events where the call trace contains cmlua.dll, indicative of Connection Manager Profile Installer (CMSTP) activity. Attackers may use CMSTP-enabled execution paths to blend in with normal system components while triggering stealthy or elevated behavior. The detection relies on Windows process access telemetry that includes the call trace string for the event.
references:
  - https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_cmstp_execution_by_access.yml
author: Nik Seetharaman, Huntrule Team
date: 2018-07-16
modified: 2021-06-27
tags:
  - attack.stealth
  - attack.t1218.003
  - attack.execution
  - attack.t1559.001
  - attack.g0069
  - attack.g0080
  - car.2019-04-001
logsource:
  product: windows
  category: process_access
detection:
  selection:
    CallTrace|contains: cmlua.dll
  condition: selection
falsepositives:
  - Legitimate CMSTP use (unlikely in modern enterprise environments)
level: high
license: DRL-1.1
related:
  - id: 3b4b232a-af90-427c-a22f-30b0c0837b95
    type: derived