huntrule

Windows Registry Events: CMSTP Execution via cmmgr32.exe TargetObject

Flags registry events referencing \cmmgr32.exe, consistent with CMSTP-related execution behavior on Windows.

FreeReviewedSigma · High · v1
Product
windows
Category
registry_event
Author
Nik Seetharaman (SigmaHQ), DRL 1.1
Published
2018-07-16
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows registry events where the TargetObject contains \cmmgr32.exe, indicating execution activity associated with the Microsoft Connection Manager Profile Installer component. Attackers can use CMSTP to blend execution into legitimate Windows mechanisms, so registry-level visibility is important for early identification. It relies on telemetry from registry_event logs that include a TargetObject field.

Reporting behind it

Related detections9 linkedT1218.003 — drag to rearrange
CMSTP Execution of an INF Profile (via process_creation)
Suspicious CMSTP Execution With INF Payload via process_creation
CMSTP UAC Bypass via Automatic Install Flag (via process_creation)
Windows: cmstp.exe Loading DLL/OCX from Suspicious Paths
Windows Network Connection from Cmstp.EXE (Outbound)
Windows: Command-line execution of cmstp.exe with INF install/silent/autobind flags (UAC bypass pattern)
Windows CMSTP UAC Bypass Attempt via Autoelevate COM Object DllHost Execution
Windows Process Access to cmlua.dll by CMSTP Connection Manager Profile Installer
Windows CMSTP Process Spawning Child Process
Windows Registry Events: CMSTP Execution via cmmgr32.exe TargetObject
Pivot detection · T1218.003 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.