Skip to content

T1218.003 CMSTP

Adversaries may abuse CMSTP to proxy execution of malicious code. The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. 2 CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections.

Adversaries may supply CMSTP.exe with INF files infected with malicious commands. 1 Similar to Regsvr32 / ”Squiblydoo”, CMSTP.exe may be abused to load and execute DLLs 3 and/or COM scriptlets (SCT) from remote servers. 6 4 5 This execution may also bypass AppLocker and other application control defenses since CMSTP.exe is a legitimate binary that may be signed by Microsoft.

CMSTP.exe can also be abused to Bypass User Account Control and execute arbitrary commands from a malicious INF through an auto-elevated COM interface. 3 4 5

Item Value
ID T1218.003
Sub-techniques T1218.001, T1218.002, T1218.003, T1218.004, T1218.005, T1218.007, T1218.008, T1218.009, T1218.010, T1218.011, T1218.012, T1218.013, T1218.014
Tactics TA0005
Platforms Windows
Version 2.1
Created 23 January 2020
Last Modified 21 April 2023

Procedure Examples

ID Name Description
G0080 Cobalt Group Cobalt Group has used the command cmstp.exe /s /ns C:\Users\ADMINI~W\AppData\Local\Temp\XKNqbpzl.txt to bypass AppLocker and launch a malicious script.789
G0069 MuddyWater MuddyWater has used CMSTP.exe and a malicious INF to execute its POWERSTATS payload.10


ID Mitigation Description
M1042 Disable or Remove Feature or Program CMSTP.exe may not be necessary within a given environment (unless using it for VPN connection installation).
M1038 Execution Prevention Consider using application control configured to block execution of CMSTP.exe if it is not required for a given system or network to prevent potential misuse by adversaries.


ID Data Source Data Component
DS0017 Command Command Execution
DS0029 Network Traffic Network Connection Creation
DS0009 Process Process Creation