Skip to content

T1218.003 CMSTP

Adversaries may abuse CMSTP to proxy execution of malicious code. The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. 2 CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections.

Adversaries may supply CMSTP.exe with INF files infected with malicious commands. 1 Similar to Regsvr32 / ”Squiblydoo”, CMSTP.exe may be abused to load and execute DLLs 3 and/or COM scriptlets (SCT) from remote servers. 6 4 5 This execution may also bypass AppLocker and other application control defenses since CMSTP.exe is a legitimate binary that may be signed by Microsoft.

CMSTP.exe can also be abused to Bypass User Account Control and execute arbitrary commands from a malicious INF through an auto-elevated COM interface. 3 4 5

Item Value
ID T1218.003
Sub-techniques T1218.001, T1218.002, T1218.003, T1218.004, T1218.005, T1218.007, T1218.008, T1218.009, T1218.010, T1218.011, T1218.012, T1218.013, T1218.014, T1218.015
Tactics TA0005
Platforms Windows
Version 2.2
Created 23 January 2020
Last Modified 24 October 2025

Procedure Examples

ID Name Description
S1149 CHIMNEYSWEEP CHIMNEYSWEEP can use CMSTP.exe to install a malicious Microsoft Connection Manager Profile.7
G0080 Cobalt Group Cobalt Group has used the command cmstp.exe /s /ns C:\Users\ADMINI~W\AppData\Local\Temp\XKNqbpzl.txt to bypass AppLocker and launch a malicious script.101112
S1202 LockBit 3.0 LockBit 3.0 can attempt a CMSTP UAC bypass if it does not have administrative privileges.8
G0069 MuddyWater MuddyWater has used CMSTP.exe and a malicious INF to execute its POWERSTATS payload.9

Mitigations

ID Mitigation Description
M1042 Disable or Remove Feature or Program CMSTP.exe may not be necessary within a given environment (unless using it for VPN connection installation).
M1038 Execution Prevention Consider using application control configured to block execution of CMSTP.exe if it is not required for a given system or network to prevent potential misuse by adversaries.

References

  1. Carr, N. (2018, January 31). Here is some early bad cmstp.exe… Retrieved September 12, 2024. ↩

  2. Microsoft. (2009, October 8). How Connection Manager Works. Retrieved April 11, 2018. ↩

  3. Moe, O. (2017, August 15). Research on CMSTP.exe. Retrieved April 11, 2018. ↩↩

  4. Moe, O. (2018, March 1). Ultimate AppLocker Bypass List. Retrieved April 10, 2018. ↩↩

  5. Seetharaman, N. (2018, July 7). Detecting CMSTP-Enabled Code Execution and UAC Bypass With Sysmon.. Retrieved November 17, 2024. ↩↩

  6. Tyrer, N. (2018, January 30). CMSTP.exe - remote .sct execution applocker bypass. Retrieved September 12, 2024. ↩

  7. Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024. ↩

  8. Walter, J. (2022, July 21). LockBit 3.0 Update | Unpicking the Ransomware’s Latest Anti-Analysis and Evasion Techniques. Retrieved February 5, 2025. ↩

  9. Singh, S. et al.. (2018, March 13). Iranian Threat Group Updates Tactics, Techniques and Procedures in Spear Phishing Campaign. Retrieved April 11, 2018. ↩

  10. Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018. ↩

  11. Gorelik, M. (2018, October 08). Cobalt Group 2.0. Retrieved November 5, 2018. ↩

  12. Unit 42. (2018, October 25). New Techniques to Uncover and Attribute Financial actors Commodity Builders and Infrastructure Revealed. Retrieved December 11, 2018. ↩