Cross-source coverage
T1191 / ATT&CK
CMSTP
ATT&CK has retired this technique. Rules still tag it; the current id is T1218.003 System Binary Proxy Execution: CMSTP.
2 rules across 1 source.
Showing deprecated rules · back to the default
From MITRE ATT&CK 19.2
The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections.
Adversaries may supply CMSTP.exe with INF files infected with malicious commands. Similar to Regsvr32 / ”Squiblydoo”, CMSTP.exe may be abused to load and execute DLLs and/or COM scriptlets (SCT) from remote servers. This execution may also bypass AppLocker and other whitelisting defenses since CMSTP.exe is a legitimate, signed Microsoft application.
CMSTP.exe can also be abused to Bypass User Account Control and execute arbitrary commands from a malicious INF through an auto-elevated COM interface.
- Platforms
- Windows
- Telemetry
- —
chronicle/detection-rules
2 rules| Detection | Severity | Format |
|---|---|---|
| cmstpexe_execution_detector_sysmon_behavior | Undefined | YARA-L |
| cmstp_uac_bypass_via_com_object_access | Undefined | YARA-L |