Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_MAL_NET_UAC_Bypass_May25

Detects .NET based tool abusing legitimate Windows utility cmstp.exe to bypass UAC (User-Admin-Controls)

MalwareSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X
Author
Jonathan Peters (cod3nym)
Date
2025-05-21
Modified
2026-05-15
Score / Quality
80 / 85

What this rule detects

Detects .NET based tool abusing legitimate Windows utility cmstp.exe to bypass UAC (User-Admin-Controls)

Targets: Windows PE.

It defines 3 patterns (1 text, 2 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
mal-net-uac-bypass-may25.yarDetection Rule License 1.1
rule SIGNATURE_BASE_MAL_NET_UAC_Bypass_May25 : FILE
{
	meta:
		description = "Detects .NET based tool abusing legitimate Windows utility cmstp.exe to bypass UAC (User-Admin-Controls)"
		author = "Jonathan Peters (cod3nym)"
		id = "bf14177f-be55-5bb1-8218-a4a734532ea4"
		date = "2025-05-21"
		modified = "2026-05-15"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_katz_stealer.yar#L90-L108"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "4f12c5dca2099492d0c0cd22edef841cbe8360af9be2d8e9b57c2f83d401c1a7"
		hash = "fcad234dc2ad5e2d8215bcf6caac29aef62666c34564e723fa6d2eee8b6468ed"
		logic_hash = "4a3f6e90af6f9a8a4dfa8e336eb8c714e5f02625ca2bf5bf8b1bca9cbda6a99e"
		score = 80
		quality = 85
		tags = "FILE"

	strings:
		$x1 = "CmstpBypass" ascii
		$x2 = { 52 00 45 00 50 00 4C 00 41 00 43 00 45 00 5F 00 43 00 4F 00 4D 00 4D 00 41 00 4E 00 44 00 5F 00 4C 00 49 00 4E 00 45 00 00 13 63 00 6D 00 73 00 74 00 70 00 2E 00 65 00 78 00 65 00 00 33 63 00 6D 00 73 00 74 00 70 00 2E 00 65 00 78 00 65 }
		$x3 = { 52 00 45 00 50 00 4C 00 41 00 43 00 45 00 5F 00 43 00 4F 00 4D 00 4D 00 41 00 4E 00 44 00 5F 00 4C 00 49 00 4E 00 45 00 0D 00 0A 00 74 00 61 00 73 00 6B 00 6B 00 69 00 6C 00 6C 00 20 00 2F 00 49 00 4D 00 20 00 63 00 6D 00 73 00 74 00 70 00 2E 00 65 00 78 00 65 }

	condition:
		uint16( 0 ) == 0x5a4d and $x1 or 1 of ( $x2 , $x3 )
}

Strings (3 patterns)

IdentifierTypeValueModifiers
$x1text"CmstpBypass"ascii
$x2hex{ 52 00 45 00 50 00 4C 00 41 00 43 00 45 00 5F 00 43 00 4F 00 4D 00 4D 00 41 00 4E 00 44 00 5F 00 4C 00 49 00 4E 00 45 00 00 13 63 00 6D 00 73 00 74 00 70 00 2E …
$x3hex{ 52 00 45 00 50 00 4C 00 41 00 43 00 45 00 5F 00 43 00 4F 00 4D 00 4D 00 41 00 4E 00 44 00 5F 00 4C 00 49 00 4E 00 45 00 0D 00 0A 00 74 00 61 00 73 00 6B 00 6B …

Condition

uint16( 0 ) == 0x5a4d and $x1 or 1 of ( $x2 , $x3 )

In plain words (Heuristic)

  • The file must start with “MZ” — a Windows executable (PE).
  • At least 1 patterns in ( $x2 , $x3 ) must match.
  • Pattern $x1 must be present.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • 4f12c5dca2099492d0c0cd22edef841cbe8360af9be2d8e9b57c2f83d401c1a7
  • fcad234dc2ad5e2d8215bcf6caac29aef62666c34564e723fa6d2eee8b6468ed

Licence & attribution

Author: Jonathan Peters (cod3nym)

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: bf14177f-be55-5bb1-8218-a4a734532ea4

Tags:FILE

Related rules