Detects .NET based tool abusing legitimate Windows utility cmstp.exe to bypass UAC (User-Admin-Controls)

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging .NET-based tools within the legitimate cmstp.exe process to execute User Account Control (UAC) bypass techniques and escalate privileges without triggering standard alerts. Proactively hunting for this behavior in Azure Sentinel is critical because attackers often exploit trusted system utilities like cmstp.exe to evade detection, allowing them to silently establish persistence or execute malicious payloads with administrative rights.

YARA Rule

rule MAL_NET_UAC_Bypass_May25 {
   meta:
      description = "Detects .NET based tool abusing legitimate Windows utility cmstp.exe to bypass UAC (User-Admin-Controls)"
      author = "Jonathan Peters (cod3nym)"
      date = "2025-05-21"
      reference = "Internal Research"
      hash = "4f12c5dca2099492d0c0cd22edef841cbe8360af9be2d8e9b57c2f83d401c1a7"
      hash = "fcad234dc2ad5e2d8215bcf6caac29aef62666c34564e723fa6d2eee8b6468ed"
      score = 80
      id = "bf14177f-be55-5bb1-8218-a4a734532ea4"
   strings:
      $x1 = "CmstpBypass" ascii
      $x2 = { 52 00 45 00 50 00 4C 00 41 00 43 00 45 00 5F 00 43 00 4F 00 4D 00 4D 00 41 00 4E 00 44 00 5F 00 4C 00 49 00 4E 00 45 00 00 13 63 00 6D 00 73 00 74 00 70 00 2E 00 65 00 78 00 65 00 00 33 63 00 6D 00 73 00 74 00 70 00 2E 00 65 00 78 00 65 }
      $x3 = { 52 00 45 00 50 00 4C 00 41 00 43 00 45 00 5F 00 43 00 4F 00 4D 00 4D 00 41 00 4E 00 44 00 5F 00 4C 00 49 00 4E 00 45 00 0D 00 0A 00 74 00 61 00 73 00 6B 00 6B 00 69 00 6C 00 6C 00 20 00 2F 00 49 00 4D 00 20 00 63 00 6D 00 73 00 74 00 70 00 2E 00 65 00 78 00 65 }
   condition:
      uint16(0) == 0x5a4d
      and $x1
      or 1 of ($x2,$x3)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• Internal Research
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule detecting .NET tools abusing cmstp.exe to bypass UAC, along with suggested filters:

• Scenario: Microsoft Office Click-to-Run Installation

  • Context: The Microsoft Office “Click-to-Run” installer often utilizes cmstp.exe as a bootstrap mechanism during the initial deployment or update phase. Since the installer is a .NET application running under a standard user context to trigger an elevation prompt, it naturally matches the detection logic of a .NET tool abusing cmstp.
  • Suggested Filter: Exclude processes where the parent executable path contains \Microsoft Office ClickToRun\ or specifically filter for the command line argument containing /install or /update, and restrict the rule to exclude known Microsoft-signed binaries.

• Scenario: SCCM (Configuration Manager) Software Deployment

  • Context: In environments using Microsoft Endpoint Configuration Manager (SCCM), software deployments often trigger cmstp.exe to handle CAB file extraction and installation logic. When a scheduled task runs a deployment package, the .NET-based SCCM client invokes cmstp to bypass UAC for silent installations of enterprise applications.
  • Suggested Filter: Create an exclusion based on the parent process name ccmexec.exe (the core SCCM agent) or filter by the specific scheduled task name containing “SoftwareCenter” or “CCMDeployment”.

• Scenario: Java Runtime Environment (JRE/JDK) Updates

  • Context: The Oracle Java Auto-Update service frequently leverages cmstp.exe to manage certificate-based trust and installation of new JRE versions. The update engine is .NET-based and often runs as a background service that triggers UAC bypasses for seamless patching without user interruption.
  • Suggested Filter: Exclude events where the command line contains references