LOLBAS Cmstp Loading Files from Suspicious Location

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects the execution of cmstp.exe, loading potentially malicious files from suspicious locations. Attackers may try to abuse the living off the land capability of the CMSTP utility to execute their malicious payloads. This technique is often used to evade detection and persist on the system.

2025-02-21 00:00:00

None

9c0765cf-13fa-41b1-8dae-212f8d730c91

attack.defense-evasion attack.t1218.003 attack.t1548.002

Nextron Sigma feed only (private)