Outbound Network Connection Initiated By Cmstp.EXE

Hunt Hypothesis

Detects a network connection initiated by Cmstp.EXE Its uncommon for “cmstp.exe” to initiate an outbound network connection. Investigate the source of such requests to determine if they are malicious.

Detection Rule

Sigma (Original)

title: Outbound Network Connection Initiated By Cmstp.EXE
id: efafe0bf-4238-479e-af8f-797bd3490d2d
status: test
description: |
    Detects a network connection initiated by Cmstp.EXE
    Its uncommon for "cmstp.exe" to initiate an outbound network connection. Investigate the source of such requests to determine if they are malicious.
references:
    - https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-30
modified: 2024-05-31
tags:
    - attack.stealth
    - attack.t1218.003
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Image|endswith: '\cmstp.exe'
        Initiated: 'true'
    filter_main_local_ranges:
        DestinationIp|cidr:
            - '127.0.0.0/8'
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
            - '169.254.0.0/16'
            - '::1/128'  # IPv6 loopback
            - 'fe80::/10'  # IPv6 link-local addresses
            - 'fc00::/7'  # IPv6 private addresses
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
# Note: Please report any false positive seen in the wild to help tune the rule.
level: high

KQL (Azure Sentinel)

imNetworkSession
| where ((SrcProcessName endswith "\\cmstp.exe" or DstProcessName endswith "\\cmstp.exe") and NetworkDirection =~ "true") and (not((ipv4_is_in_range(DstIpAddr, "127.0.0.0/8") or ipv4_is_in_range(DstIpAddr, "10.0.0.0/8") or ipv4_is_in_range(DstIpAddr, "172.16.0.0/12") or ipv4_is_in_range(DstIpAddr, "192.168.0.0/16") or ipv4_is_in_range(DstIpAddr, "169.254.0.0/16") or ipv4_is_in_range(DstIpAddr, "::1/128") or ipv4_is_in_range(DstIpAddr, "fe80::/10") or ipv4_is_in_range(DstIpAddr, "fc00::/7"))))

Required Data Sources

False Positive Guidance

• Unknown

MITRE ATT&CK Context

• Technique: T1218.003 — T1218.003

References

• https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/
• SigmaHQ Rule