Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

SafePay – Regsvr32/CMSTP Proxy Execution for Defense Evasion

Safepay Defense Evasion Sentinel
MITRE ATT&CK
Regsvr32
Data Source
DeviceProcessEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group_tools dataset (safepay)
What This Detects
SafePay abuses signed Windows binaries (regsvr32.exe with a remote scriptlet, cmstp.exe spawned via dllhost.exe/CMSTPLUA) to proxy execution past application allow-listing.
Query
DeviceProcessEvents
| where Timestamp > ago(1d)
| where (FileName =~ "regsvr32.exe" and ProcessCommandLine has_any ("scrobj.dll","/i:http","/n /i"))
   or (InitiatingProcessFileName =~ "dllhost.exe" and FileName =~ "cmstp.exe")
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.