Bypass UAC via CMSTP — Detection Rule

Detect commandline usage of Microsoft Connection Manager Profile Installer (cmstp.exe) to install specially formatted local .INF files

Read the full analysis on IntelFusions