1200KM / detection
T1218.003 CMSTP — Detection Rules
Detection workspace for T1218.003 CMSTP: 7 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
- DLL Loaded From Suspicious Location Via Cmspt.EXE · test · high · {"category":"image_load","product":"windows"}
- Outbound Network Connection Initiated By Cmstp.EXE · test · high · {"category":"network_connection","product":"windows"}
- CMSTP Execution Process Access · stable · high · {"product":"windows","category":"process_access"}
- CMSTP Execution Process Creation · stable · high · {"category":"process_creation","product":"windows"}
- Bypass UAC via CMSTP · test · high · {"category":"process_creation","product":"windows"}
- CMSTP UAC Bypass via COM Object Access · stable · high · {"category":"process_creation","product":"windows"}
- CMSTP Execution Registry Event · stable · high · {"category":"registry_event","product":"windows"}
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0328 Detection of Malicious Profile Installation via CMSTP.exe
AN0932 Analytic 0932
Execution of CMSTP.exe with arguments pointing to suspicious or remote INF/SCT/DLL payloads, optionally followed by outbound network connections to untrusted IPs, process injection via COM interfaces (CMSTPLUA, CMLUAUTIL), registry modifications registering malicious profiles, or creation of suspicious INF/DLL/SCT files prior to execution.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
T1218.003 simulation workspace
- Command Execution · DC0064
- File Creation · DC0039
- Network Connection Creation · DC0082
- Process Access · DC0035
- Process Creation · DC0032
- Windows Registry Key Creation · DC0056
- Windows Registry Key Modification · DC0063
No reviewed association in this snapshot.
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.