tfMITRE ATT&CK sub-technique

CMSTP T1218.003

sub-technique of T1218 System Binary Proxy Execution

Tactic: Stealth
Platform: Windows
Version: 3.0
Created: 23 January 2020
Last modified: 12 May 2026
Contributors: Nik Seetharaman, Palantir; Ye Yint Min Thu Htut, Offensive Security Team, DBS Bank

Adversaries may abuse CMSTP to proxy execution of malicious code. The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. [1] CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups56th pct

Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware51st pct

Tools & malware51st percentile · 51% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 23%

Detection rules77th percentile · 77% of ATT&CK techniques have this many detection rules written or fewer.

CMSTP MITRE reference T1218.003

56th pctamong all ATT&CK techniques for number of groups

2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Cobalt GroupG0080 ↗

Has used the command cmstp.exe /s /ns C:\Users\ADMINI~W\AppData\Local\Temp\XKNqbpzl.txt to bypass AppLocker and launch a malicious script.1 2 3

created 2018-10-173 referencesaka GOLD KINGSWOOD

MuddyWaterG0069 ↗

Has used CMSTP.exe and a malicious INF to execute its POWERSTATS payload.1

created 2018-04-181 referenceaka Earth Vetala

All 2 groups for this technique

Offense vs defense T1218.003

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 7Splunk ESCU (cumulative) · 4

first rule: 2018 Q3

CMSTP detection strategy DET0328

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of Malicious Profile Installation via CMSTP.exe

Enterprise

1 platform

AN0932 · Windows

Execution of CMSTP.exe with arguments pointing to suspicious or remote INF/SCT/DLL payloads, optionally followed by outbound network connections to untrusted IPs, process injection via COM interfaces (CMSTPLUA, CMLUAUTIL), registry modifications registering malicious profiles, or creation of suspicious INF/DLL/SCT files prior to execution.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Process AccessDC0035	WinEventLog:Sysmon	EventCode=10
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Windows Registry Key CreationDC0056	WinEventLog:Sysmon	EventCode=12
Windows Registry Key ModificationDC0063	WinEventLog:Sysmon	EventCode=13, 14
Command ExecutionDC0064	WinEventLog:PowerShell	EventCode=4103, 4104, 4105, 4106
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
INFPathRegex	Regex for identifying suspicious INF files; adjust to suppress known safe profiles
ExternalIPAllowlist	Domains or IP ranges allowed for CMSTP network connections
COMInterfaceGUIDs	Set of auto-elevated COM interface GUIDs to flag (e.g., CMSTPLUA, CMLUAUTIL)
RegistryKeyAllowlist	Known good registry entries for CMSTP profile registration
TimeWindow	Correlate CMSTP execution with subsequent network activity or process creation within N seconds

1 analytic

CMSTP.exe is the Microsoft Connection Manager Profile Installer, which can be leveraged to setup listeners that will receive and install malware from remote sources in trusted fashion. When CMSTP.exe is seen in combination with an external connection, it is a good indication of this TTP.

TypeTTPCoverageHighSubmitted2020

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PSA	Process Spawn Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	exe
process	create	src_ip

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

This is a pseudocode representation of the below splunk search.

processes = search Process:Create
target_processes = filter processes where (
  exe="C:\Windows\System32\CMSTP.exe" AND
  src_ip NOT IN [10.0.0.0/8,192.168.0.0/16, 172.16.0.0/12] )
output target_processes

looks for instances of CMSTP.exe that are combined with external communication

(index=__your_sysmon_index__ EventCode=3) Image="C:\\Windows\\System32\\CMSTP.exe" | where ((!cidrmatch("10.0.0.0/8", SourceIp) AND !cidrmatch("192.168.0.0/16", SourceIp) AND !cidrmatch("172.16.0.0/12", SourceIp))

looks for instances of CMSTP.exe that are combined with external communication

norm_id=WindowsSysmon event_id=3 image="C:\Windows\System32\CMSTP.exe" -source_address IN HOMENET

Tests2Executorscmd 2Need elevation0 of 2Have prerequisites2Have cleanup0Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

CMSTP Executing Remote Scriptlet

windows

cmd

—

Adversaries may supply CMSTP.exe with INF files infected with malicious commands

Input arguments

Name	Type	Default	Description
inf_file_path	path	PathToAtomicsFolder\T1218.003\src\T1218.003.inf	Path to the INF file

Attack command

cmstp.exe /s "#{inf_file_path}"

Prerequisite

INF file must exist on disk at specified location (#{inf_file_path})

Check

if (Test-Path "#{inf_file_path}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{inf_file_path}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.003/src/T1218.003.inf" -OutFile "#{inf_file_path}"

GUID4218936b-950a-4bca-ac5e-c6b469f77002

CMSTP Executing UAC Bypass

windows

cmd

—

Adversaries may invoke cmd.exe (or other malicious commands) by embedding them in the RunPreSetupCommandsSection of an INF file

Input arguments

Name	Type	Default	Description
inf_file_uac	path	PathToAtomicsFolder\T1218.003\src\T1218.003_uacbypass.inf	Path to the INF file

Attack command

cmstp.exe /s "#{inf_file_uac}" /au

Prerequisite

INF file must exist on disk at specified location (#{inf_file_uac})

Check

if (Test-Path "#{inf_file_uac}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{inf_file_uac}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.003/src/T1218.003_uacbypass.inf" -OutFile "#{inf_file_uac}"

GUID2a782982-87e0-4264-a527-889d05f617eb

Tests from Atomic Red Team (MIT licence) · technique definition

CMSTP detections T1218.003

11 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 23%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs