{"id":"75e508f7-932d-4ebc-af77-269237a84ce1","title":"DLL Loaded From Suspicious Location Via Cmspt.EXE","description":"Detects cmstp loading \"dll\" or \"ocx\" files from suspicious locations","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-08-30","modified":"2023-02-17","tags":["attack.stealth","attack.t1218.003"],"technique_ids":["T1218.003"],"logsource":{"category":"image_load","product":"windows"},"falsepositives":["Unikely"],"references":["https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/TTPs/Defense%20Evasion/T1218%20-%20Signed%20Binary%20Proxy%20Execution/T1218.003%20-%20CMSTP/Procedures.yaml"],"source_path":"rules/windows/image_load/image_load_cmstp_load_dll_from_susp_location.yml","source_sha256":"1076ecced55d632cec91ec405f61824b780f269191ced738d0f333ae97930a5c","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_cmstp_load_dll_from_susp_location.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: DLL Loaded From Suspicious Location Via Cmspt.EXE\nid: 75e508f7-932d-4ebc-af77-269237a84ce1\nstatus: test\ndescription: Detects cmstp loading \"dll\" or \"ocx\" files from suspicious locations\nreferences:\n    - https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/TTPs/Defense%20Evasion/T1218%20-%20Signed%20Binary%20Proxy%20Execution/T1218.003%20-%20CMSTP/Procedures.yaml\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-08-30\nmodified: 2023-02-17\ntags:\n    - attack.stealth\n    - attack.t1218.003\nlogsource:\n    category: image_load\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\cmstp.exe'\n        ImageLoaded|contains:\n            # Add more suspicious paths as you see fit in your env\n            - '\\PerfLogs\\'\n            - '\\ProgramData\\'\n            - '\\Users\\'\n            - '\\Windows\\Temp\\'\n            - 'C:\\Temp\\'\n        ImageLoaded|endswith:\n            - '.dll'\n            - '.ocx'\n    condition: selection\nfalsepositives:\n    - Unikely\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1218.003","id":"T1218.003","name":"CMSTP","page":"techniques/enterprise/T1218.003/"}],"data_path":"data/detection-rules/75e508f7-932d-4ebc-af77-269237a84ce1.json","kind":"sigma"}