T1218.003sub-technique of T1218 System Binary Proxy Execution
CMSTP
Windowsnothing on this site yetT1218.003 on attack.mitre.org
Adversaries may abuse CMSTP to proxy execution of malicious code. The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections. Adversaries may supply CMSTP.exe with INF files infected with malicious commands.
how MITRE says to see it
Detection of Malicious Profile Installation via CMSTP.exe
- Execution of CMSTP.exe with arguments pointing to suspicious or remote INF/SCT/DLL payloads, optionally followed by outbound network connections to untrusted IPs, process injection via COM interfaces (CMSTPLUA, CMLUAUTIL), registry modifications registering malicious profiles, or creation of suspicious INF/DLL/SCT...
what reduces it
- M1038 Execution Prevention. Consider using application control configured to block execution of CMSTP.exe if it is not required for a given system or network to prevent potential misuse by adversaries.
- M1042 Disable or Remove Feature or Program. CMSTP.exe may not be necessary within a given environment (unless using it for VPN connection installation).