CMSTP Execution Process Access (3b4b232a-af90-427c-a22f-30b0c0837b95)

Detects various indicators of Microsoft Connection Manager Profile Installer execution

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
CMSTP - T1218.003 (4cbc6a62-9e34-4f94-8a19-5c1a11392a49)	Attack Pattern	CMSTP Execution Process Access (3b4b232a-af90-427c-a22f-30b0c0837b95)	Sigma-Rules	1
CMSTP Execution Process Access (3b4b232a-af90-427c-a22f-30b0c0837b95)	Sigma-Rules	Component Object Model - T1559.001 (2f6b4ed7-fef1-44ba-bcb8-1b4beb610b64)	Attack Pattern	1
CMSTP - T1218.003 (4cbc6a62-9e34-4f94-8a19-5c1a11392a49)	Attack Pattern	System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4)	Attack Pattern	2
Inter-Process Communication - T1559 (acd0ba37-7ba9-4cc5-ac61-796586cd856d)	Attack Pattern	Component Object Model - T1559.001 (2f6b4ed7-fef1-44ba-bcb8-1b4beb610b64)	Attack Pattern	2