type: attack-pattern
spec_version: 2.1
id: attack-pattern--4cbc6a62-9e34-4f94-8a19-5c1a11392a49
created: 2020-01-23T18:27:30.656Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1218/003
external_id: T1218.003
source_name: Twitter CMSTP Usage Jan 2018
description: Carr, N. (2018, January 31). Here is some early bad cmstp.exe... Retrieved September 12, 2024.
url: https://x.com/ItsReallyNick/status/958789644165894146
source_name: Microsoft Connection Manager Oct 2009
description: Microsoft. (2009, October 8). How Connection Manager Works. Retrieved April 11, 2018.
url: https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2003/cc786431(v=ws.10)
source_name: MSitPros CMSTP Aug 2017
description: Moe, O. (2017, August 15). Research on CMSTP.exe. Retrieved April 11, 2018.
url: https://msitpros.com/?p=3960
source_name: GitHub Ultimate AppLocker Bypass List
description: Moe, O. (2018, March 1). Ultimate AppLocker Bypass List. Retrieved April 10, 2018.
url: https://github.com/api0cradle/UltimateAppLockerByPassList
source_name: Endurant CMSTP July 2018
description: Seetharaman, N. (2018, July 7). Detecting CMSTP-Enabled Code Execution and UAC Bypass With Sysmon.. Retrieved November 17, 2024.
url: https://web.archive.org/web/20190316220149/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/
source_name: Twitter CMSTP Jan 2018
description: Tyrer, N. (2018, January 30). CMSTP.exe - remote .sct execution applocker bypass. Retrieved September 12, 2024.
url: https://x.com/NickTyrer/status/958450014111633408
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:45.149Z
name: CMSTP
description: Adversaries may abuse CMSTP to proxy execution of malicious code. The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. (Citation: Microsoft Connection Manager Oct 2009) CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections.

Adversaries may supply CMSTP.exe with INF files infected with malicious commands. (Citation: Twitter CMSTP Usage Jan 2018) Similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010) / ”Squiblydoo”, CMSTP.exe may be abused to load and execute DLLs (Citation: MSitPros CMSTP Aug 2017) and/or COM scriptlets (SCT) from remote servers. (Citation: Twitter CMSTP Jan 2018) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018) This execution may also bypass AppLocker and other application control defenses since CMSTP.exe is a legitimate binary that may be signed by Microsoft.

CMSTP.exe can also be abused to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002) and execute arbitrary commands from a malicious INF through an auto-elevated COM interface. (Citation: MSitPros CMSTP Aug 2017) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018)
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: defense-evasion
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Nik Seetharaman, Palantir
Ye Yint Min Thu Htut, Offensive Security Team, DBS Bank
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_version: 2.2