Bypass UAC via CMSTP

Status: test
Severity: high
Log source: category process_creation, product windows
Author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
Source: github.com/SigmaHQ/sigma

Detect commandline usage of Microsoft Connection Manager Profile Installer (cmstp.exe) to install specially formatted local .INF files

Known false positives

Legitimate use of cmstp.exe utility by legitimate user

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1548.002` Abuse Elevation Control Mechanism: Bypass User Account Control
Stealth	`T1218.003` System Binary Proxy Execution: CMSTP

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Bypass UAC via CMSTP
id: e66779cc-383e-4224-a3a4-267eeb585c40
status: test
description: Detect commandline usage of Microsoft Connection Manager Profile Installer (cmstp.exe) to install specially formatted local .INF files
references:
    - https://eqllib.readthedocs.io/en/latest/analytics/e584f1a1-c303-4885-8a66-21360c90995b.html
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.003/T1218.003.md
    - https://lolbas-project.github.io/lolbas/Binaries/Cmstp/
author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
date: 2019-10-24
modified: 2022-08-30
tags:
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1548.002
    - attack.t1218.003
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\cmstp.exe'
        - OriginalFileName: 'CMSTP.EXE'
    selection_cli:
        CommandLine|contains:
            - '/s'
            - '-s'
            - '/au'
            - '-au'
            - '/ni'
            - '-ni'
    condition: all of selection*
falsepositives:
    - Legitimate use of cmstp.exe utility by legitimate user
level: high

Stages and Predicates

Stage 0: `condition`

all of selection*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\cmstp.exe'
    - OriginalFileName: 'CMSTP.EXE'

Stage 2: `selection_cli`

selection_cli:
    CommandLine|contains:
        - '/s'
        - '-s'
        - '/au'
        - '-au'
        - '/ni'
        - '-ni'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-au` `-ni` `-s` corpus 10 (sigma 4, kusto 4, elastic 1, splunk 1) `/au` `/ni` `/s` corpus 8 (sigma 6, splunk 2)	`field:"CommandLine" kind:match`
`Image`	ends_with	`\cmstp.exe` corpus 8 (sigma 8)	`field:"Image" kind:ends_with value:"\cmstp.exe"`
`OriginalFileName`	eq	`CMSTP.EXE` corpus 11 (elastic 6, sigma 5)	`field:"OriginalFileName" kind:eq value:"CMSTP.EXE"`

Bypass UAC via CMSTP

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_img

Stage 2: selection_cli

Indicators

Stage 0: `condition`

Stage 1: `selection_img`

Stage 2: `selection_cli`