MITRE CAR unknown stable spl
CMSTP
CMSTP.exe is the Microsoft Connection Manager Profile Installer, which can be leveraged to setup listeners that will receive and install malware from remote sources in trusted fashion. When CMSTP.exe is seen in combination with an external connection, it is a good indication of this TTP.
Detection Logic
(index=__your_sysmon_index__ EventCode=3) Image="C:\\Windows\\System32\\CMSTP.exe"
| where ((!cidrmatch("10.0.0.0/8", SourceIp)
AND !cidrmatch("192.168.0.0/16", SourceIp)
AND !cidrmatch("172.16.0.0/12", SourceIp))Field Validations
Loading…
Comments (0)
Loading comments...