Potential UAC Bypass via Cmstp - Taskkill of Cmstp.exe

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects the execution of "taskkill /IM cmstp.exe /F" command which is hardcoded in INF files used for UAC bypass through LOLBAS cmstp.exe binary. Attackers may try to abuse the living off the land capability of the CMSTP utility to execute their malicious payloads. This technique is often used to evade detection and persist on the system.

2025-02-21 00:00:00

None

4a988407-237c-48b8-9318-ca287154878c

attack.defense-evasion attack.t1218.003 attack.t1548.002

Nextron Sigma feed only (private)