Outbound Network Connection Initiated By Cmstp.EXE

Title: Outbound Network Connection Initiated By Cmstp.EXE
Status: test
Description:Detects a network connection initiated by Cmstp.EXE Its uncommon for "cmstp.exe" to initiate an outbound network connection. Investigate the source of such requests to determine if they are malicious.
References:
  -https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-30
modified:2024-05-31
Tags:

• -'attack.stealth'
• -'attack.t1218.003'

Logsource:

• category: network_connection
• product: windows

Detection:
  selection:
    Image|endswith: '\cmstp.exe'
    Initiated: 'true'
  filter_main_local_ranges:
    DestinationIp|cidr:
      -'127.0.0.0/8'
      -'10.0.0.0/8'
      -'172.16.0.0/12'
      -'192.168.0.0/16'
      -'169.254.0.0/16'
      -'::1/128'
      -'fe80::/10'
      -'fc00::/7'

  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Unknown
Level: high