ATT&CK technique

T1218.003

CMSTP

Stealth 21 detections found

Detection rules

Source	Rule	Status	Updated
elastic	Unusual Network Activity from a Windows System Binary	production	2026-10-19
elastic	Suspicious MS Outlook Child Process	production	2026-09-18
elastic	Suspicious MS Office Child Process	production	2026-09-18
elastic	Suspicious JetBrains TeamCity Child Process	production	2026-09-18
elastic	Suspicious PDF Reader Child Process	production	2026-09-18
elastic	Suspicious Managed Code Hosting Process	production	2026-09-18
elastic	Suspicious .NET Code Compilation	production	2026-09-18
elastic	Execution from Unusual Directory - Command Line	production	2026-09-18
elastic	Delayed Execution via Ping	production	2026-09-18
elastic	Unusual Process Network Connection	production	2026-09-18
sigma	CMSTP App Paths Registry Key Modification	stable	2026-08-27
splunk	Windows Unusual Process Load Mozilla NSS-Mozglue Module	production	2026-06-25
splunk	Wbemprox COM Object Execution	production	2026-05-13
splunk	UAC Bypass With Colorui COM Object	production	2026-05-13
splunk	CMLUA Or CMSTPLUA UAC Bypass	production	2026-05-13
sigma	CMSTP UAC Bypass via COM Object Access	stable	2024-12-01
sigma	Outbound Network Connection Initiated By Cmstp.EXE	test	2024-05-31
sigma	DLL Loaded From Suspicious Location Via Cmspt.EXE	test	2023-02-17
sigma	Bypass UAC via CMSTP	test	2022-08-30
sigma	CMSTP Execution Process Access	stable	2021-06-27
sigma	CMSTP Execution Process Creation	stable	2020-12-23