Windows Registry Events: CMSTP Execution via cmmgr32.exe TargetObject

Flags registry events referencing \cmmgr32.exe, consistent with CMSTP-related execution behavior on Windows.

FreeUnreviewedSigmahighv1

windows-registry-events-cmstp-execution-via-cmmgr32-exe-targetobject-b6d235fc

title: "Windows Registry Events: CMSTP Execution via cmmgr32.exe TargetObject"
id: 3e644490-5ebd-49ba-88c6-99d87108342d
status: stable
description: This rule flags Windows registry events where the TargetObject contains \cmmgr32.exe, indicating execution activity associated with the Microsoft Connection Manager Profile Installer component. Attackers can use CMSTP to blend execution into legitimate Windows mechanisms, so registry-level visibility is important for early identification. It relies on telemetry from registry_event logs that include a TargetObject field.
references:
  - https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_cmstp_execution_by_registry.yml
author: Nik Seetharaman, Huntrule Team
date: 2018-07-16
modified: 2020-12-23
tags:
  - attack.execution
  - attack.stealth
  - attack.t1218.003
  - attack.g0069
  - car.2019-04-001
logsource:
  category: registry_event
  product: windows
detection:
  selection:
    TargetObject|contains: \cmmgr32.exe
  condition: selection
falsepositives:
  - Legitimate CMSTP use (unlikely in modern enterprise environments)
level: high
license: DRL-1.1
related:
  - id: b6d235fc-1d38-4b12-adbe-325f06728f37
    type: derived

What it detects

This rule flags Windows registry events where the TargetObject contains \cmmgr32.exe, indicating execution activity associated with the Microsoft Connection Manager Profile Installer component. Attackers can use CMSTP to blend execution into legitimate Windows mechanisms, so registry-level visibility is important for early identification. It relies on telemetry from registry_event logs that include a TargetObject field.

Known false positives

Legitimate CMSTP use (unlikely in modern enterprise environments)

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.