Cross-source coverage

T1218.003 / ATT&CK

System Binary Proxy Execution: CMSTP

25 rules across 5 sources.

Showing deprecated rules · back to the default

From MITRE ATT&CK 19.2

Adversaries may abuse CMSTP to proxy execution of malicious code. The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections.

Adversaries may supply CMSTP.exe with INF files infected with malicious commands. Similar to Regsvr32 / ”Squiblydoo”, CMSTP.exe may be abused to load and execute DLLs and/or COM scriptlets (SCT) from remote servers. This execution may also bypass AppLocker and other application control defenses since CMSTP.exe is a legitimate binary that may be signed by Microsoft.

CMSTP.exe can also be abused to Bypass User Account Control and execute arbitrary commands from a malicious INF through an auto-elevated COM interface.

Tactics
Stealth
Platforms
Windows
Telemetry
WinEventLog:PowerShellWinEventLog:Sysmon

How MITRE says to detect it DET0328

Detection of Malicious Profile Installation via CMSTP.exe

Windows Analytic 0932

Execution of CMSTP.exe with arguments pointing to suspicious or remote INF/SCT/DLL payloads, optionally followed by outbound network connections to untrusted IPs, process injection via COM interfaces (CMSTPLUA, CMLUAUTIL), registry modifications registering malicious profiles, or creation of suspicious INF/DLL/SCT files prior to execution.

  • WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106
  • WinEventLog:Sysmon EventCode=3, 22
  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:Sysmon EventCode=10
  • WinEventLog:Sysmon EventCode=12
  • WinEventLog:Sysmon EventCode=13, 14
  • WinEventLog:Sysmon EventCode=11

View on attack.mitre.org ↗

elastic/detection-rules

10 rules
Detection Severity Format
Suspicious Managed Code Hosting Process High Elastic TOML
Execution from Unusual Directory - Command Line Medium Elastic TOML
Suspicious JetBrains TeamCity Child Process Medium Elastic TOML
Suspicious MS Office Child Process Medium Elastic TOML
Suspicious .NET Code Compilation Medium Elastic TOML
Unusual Network Activity from a Windows System Binary Medium Elastic TOML
Delayed Execution via Ping Low Elastic TOML
Suspicious MS Outlook Child Process Low Elastic TOML
Suspicious PDF Reader Child Process Low Elastic TOML
Unusual Process Network Connection Low Elastic TOML

SigmaHQ/sigma

7 rules
Detection Severity Format
Bypass UAC via CMSTP High Sigma
CMSTP Execution Process Access High Sigma
CMSTP Execution Process Creation High Sigma
CMSTP Execution Registry Event High Sigma
CMSTP UAC Bypass via COM Object Access High Sigma
DLL Loaded From Suspicious Location Via Cmspt.EXE High Sigma
Outbound Network Connection Initiated By Cmstp.EXE High Sigma

splunk/security_content

4 rules
Detection Severity Format
CMLUA Or CMSTPLUA UAC Bypass Undefined SPL
UAC Bypass With Colorui COM Object Undefined SPL
Wbemprox COM Object Execution Undefined SPL
Windows Unusual Process Load Mozilla NSS-Mozglue Module Undefined SPL

elastic/protections-artifacts

3 rules
Detection Severity Format
Inhibit System Recovery via Signed Binary Proxy Undefined Elastic TOML
Scriptlet Execution via CMSTP Undefined Elastic TOML
Suspicious Windows Schedule Child Process Undefined Elastic TOML

chronicle/detection-rules

1 rule
Detection Severity Format
possible_privilege_escalation_attack_using_dllhostexe Undefined YARA-L

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.