Windows Process Access to cmlua.dll by CMSTP Connection Manager Profile Installer

Alerts on Windows process access events whose call trace includes cmlua.dll, indicating potential CMSTP-related execution.

FreeReviewedSigma · High · v2

Product: windows
Category: process_access
Author: Nik Seetharaman (SigmaHQ), DRL 1.1
Published: 2018-07-16
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1559.001Component Object Model
Persistence
Priv Esc
Defense Evasion
- T1218.003CMSTP
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

Identifies process access events where the call trace contains cmlua.dll, indicating CMSTP Connection Manager Profile Installer activity tied to UAC-related behavior. Attackers can use CMSTP-enabled execution paths to run code indirectly and evade user awareness. The rule relies on Windows process access telemetry that includes a call trace string containing cmlua.dll.

Reporting behind it

Related detections9 linkedT1218.003 — drag to rearrange

CMSTP Execution of an INF Profile (via process_creation)

Suspicious CMSTP Execution With INF Payload via process_creation

CMSTP UAC Bypass via Automatic Install Flag (via process_creation)

Windows: cmstp.exe Loading DLL/OCX from Suspicious Paths

Windows Network Connection from Cmstp.EXE (Outbound)

Windows Dllhost.exe Network Connections to Non-Local IP Addresses

Windows DNS Queries Initiated by Regsvr32.exe

Windows Regsvr32.exe Initiated Network Connection

Windows: Command-line execution of cmstp.exe with INF install/silent/autobind flags (UAC bypass pattern)

Windows Process Access to cmlua.dll by CMSTP Connection Manager Profile Installer

Pivot detection · T1218.003 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-access-involving-cmlua-dll-during-cmstp-execution-3b4b232a

title: Windows Process Access to cmlua.dll by CMSTP Connection Manager Profile Installer
id: ae268f52-a2ea-4915-af6d-6515678beffa
status: stable
description: Identifies process access events where the call trace contains cmlua.dll, indicating CMSTP Connection Manager Profile Installer activity tied to UAC-related behavior. Attackers can use CMSTP-enabled execution paths to run code indirectly and evade user awareness. The rule relies on Windows process access telemetry that includes a call trace string containing cmlua.dll.
references:
  - https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_cmstp_execution_by_access.yml
author: Nik Seetharaman, Huntrule Team
date: 2018-07-16
modified: 2021-06-27
tags:
  - attack.stealth
  - attack.t1218.003
  - attack.execution
  - attack.t1559.001
  - attack.g0069
  - attack.g0080
  - car.2019-04-001
logsource:
  product: windows
  category: process_access
detection:
  selection:
    CallTrace|contains: cmlua.dll
  condition: selection
falsepositives:
  - Legitimate CMSTP use (unlikely in modern enterprise environments)
level: high
license: DRL-1.1
related:
  - id: 3b4b232a-af90-427c-a22f-30b0c0837b95
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL