Elastic Defend high stable eql
Scriptlet Execution via CMSTP
Identifies when scrobj.dll is loaded into the Microsoft Connection Manager Profile Installer (cmstp.exe) process. This may indicate an attempt to bypass application whitelisting by executing a malicious scriptlet in a trusted process.
Detection Logic
sequence by process.entity_id with maxspan=1m
[process where event.action == "start" and process.pe.original_file_name == "CMSTP.EXE"]
[library where dll.name : "scrobj.dll"]Field Validations
Loading…
Comments (0)
Loading comments...