Execution via cmstp.exe

Identifies potentially stealthy execution via the Microsoft Connection Manager Profile Installer.

id:56c64a8c-a787-488a-a7f2-b992d332679d
categories:enrich
confidence:low
os:windows
created:7/26/2019
updated:7/26/2019

MITRE ATT&CK™ Mapping

tactics:Defense Evasion, Execution
techniques:T1191 CMSTP

Query

process where subtype.create and
  process_name == "cmstp.exe" and
  command_line == "* /s *"

Contributors