Windows Registry Events: CMSTP Execution via cmmgr32.exe TargetObject

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1218.003CMSTP
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows registry events where the TargetObject contains \cmmgr32.exe, indicating execution activity associated with the Microsoft Connection Manager Profile Installer component. Attackers can use CMSTP to blend execution into legitimate Windows mechanisms, so registry-level visibility is important for early identification. It relies on telemetry from registry_event logs that include a TargetObject field.

Reporting behind it

Related detections9 linkedT1218.003 — drag to rearrange

CMSTP Execution of an INF Profile (via process_creation)

Suspicious CMSTP Execution With INF Payload via process_creation

CMSTP UAC Bypass via Automatic Install Flag (via process_creation)

Windows: cmstp.exe Loading DLL/OCX from Suspicious Paths

Windows Network Connection from Cmstp.EXE (Outbound)

Windows: Command-line execution of cmstp.exe with INF install/silent/autobind flags (UAC bypass pattern)

Windows CMSTP UAC Bypass Attempt via Autoelevate COM Object DllHost Execution

Windows Process Access to cmlua.dll by CMSTP Connection Manager Profile Installer

Windows CMSTP Process Spawning Child Process

Windows Registry Events: CMSTP Execution via cmmgr32.exe TargetObject

Pivot detection · T1218.003 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-registry-events-cmstp-execution-via-cmmgr32-exe-targetobject-b6d235fc

title: "Windows Registry Events: CMSTP Execution via cmmgr32.exe TargetObject"
id: 3e644490-5ebd-49ba-88c6-99d87108342d
status: stable
description: This rule flags Windows registry events where the TargetObject contains \cmmgr32.exe, indicating execution activity associated with the Microsoft Connection Manager Profile Installer component. Attackers can use CMSTP to blend execution into legitimate Windows mechanisms, so registry-level visibility is important for early identification. It relies on telemetry from registry_event logs that include a TargetObject field.
references:
  - https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_cmstp_execution_by_registry.yml
author: Nik Seetharaman, Huntrule Team
date: 2018-07-16
modified: 2020-12-23
tags:
  - attack.execution
  - attack.stealth
  - attack.t1218.003
  - attack.g0069
  - car.2019-04-001
logsource:
  category: registry_event
  product: windows
detection:
  selection:
    TargetObject|contains: \cmmgr32.exe
  condition: selection
falsepositives:
  - Legitimate CMSTP use (unlikely in modern enterprise environments)
level: high
license: DRL-1.1
related:
  - id: b6d235fc-1d38-4b12-adbe-325f06728f37
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL