Cross-source coverage
T1218.003 / ATT&CK
System Binary Proxy Execution: CMSTP
24 rules across 4 sources.
1 deprecated hidden · include
From MITRE ATT&CK 19.2
Adversaries may abuse CMSTP to proxy execution of malicious code. The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections.
Adversaries may supply CMSTP.exe with INF files infected with malicious commands. Similar to Regsvr32 / ”Squiblydoo”, CMSTP.exe may be abused to load and execute DLLs and/or COM scriptlets (SCT) from remote servers. This execution may also bypass AppLocker and other application control defenses since CMSTP.exe is a legitimate binary that may be signed by Microsoft.
CMSTP.exe can also be abused to Bypass User Account Control and execute arbitrary commands from a malicious INF through an auto-elevated COM interface.
- Tactics
- Stealth
- Platforms
- Windows
- Telemetry
-
WinEventLog:PowerShellWinEventLog:Sysmon
How MITRE says to detect it DET0328
Detection of Malicious Profile Installation via CMSTP.exe
Windows Analytic 0932
Execution of CMSTP.exe with arguments pointing to suspicious or remote INF/SCT/DLL payloads, optionally followed by outbound network connections to untrusted IPs, process injection via COM interfaces (CMSTPLUA, CMLUAUTIL), registry modifications registering malicious profiles, or creation of suspicious INF/DLL/SCT files prior to execution.
WinEventLog:PowerShellEventCode=4103, 4104, 4105, 4106WinEventLog:SysmonEventCode=3, 22WinEventLog:SysmonEventCode=1WinEventLog:SysmonEventCode=10WinEventLog:SysmonEventCode=12WinEventLog:SysmonEventCode=13, 14WinEventLog:SysmonEventCode=11
elastic/detection-rules
10 rules| Detection | Severity | Format |
|---|---|---|
| Suspicious Managed Code Hosting Process | High | Elastic TOML |
| Execution from Unusual Directory - Command Line | Medium | Elastic TOML |
| Suspicious JetBrains TeamCity Child Process | Medium | Elastic TOML |
| Suspicious MS Office Child Process | Medium | Elastic TOML |
| Suspicious .NET Code Compilation | Medium | Elastic TOML |
| Unusual Network Activity from a Windows System Binary | Medium | Elastic TOML |
| Delayed Execution via Ping | Low | Elastic TOML |
| Suspicious MS Outlook Child Process | Low | Elastic TOML |
| Suspicious PDF Reader Child Process | Low | Elastic TOML |
| Unusual Process Network Connection | Low | Elastic TOML |
SigmaHQ/sigma
7 rules| Detection | Severity | Format |
|---|---|---|
| Bypass UAC via CMSTP | High | Sigma |
| CMSTP Execution Process Access | High | Sigma |
| CMSTP Execution Process Creation | High | Sigma |
| CMSTP Execution Registry Event | High | Sigma |
| CMSTP UAC Bypass via COM Object Access | High | Sigma |
| DLL Loaded From Suspicious Location Via Cmspt.EXE | High | Sigma |
| Outbound Network Connection Initiated By Cmstp.EXE | High | Sigma |
splunk/security_content
4 rules| Detection | Severity | Format |
|---|---|---|
| CMLUA Or CMSTPLUA UAC Bypass | Undefined | SPL |
| UAC Bypass With Colorui COM Object | Undefined | SPL |
| Wbemprox COM Object Execution | Undefined | SPL |
| Windows Unusual Process Load Mozilla NSS-Mozglue Module | Undefined | SPL |
elastic/protections-artifacts
3 rules| Detection | Severity | Format |
|---|---|---|
| Inhibit System Recovery via Signed Binary Proxy | Undefined | Elastic TOML |
| Scriptlet Execution via CMSTP | Undefined | Elastic TOML |
| Suspicious Windows Schedule Child Process | Undefined | Elastic TOML |