Adversaries may abuse CMSTP to proxy execution of malicious code. The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. [1] CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections.
Adversaries may supply CMSTP.exe with INF files infected with malicious commands. [2] Similar to Regsvr32 / "Squiblydoo", CMSTP.exe may be abused to load and execute DLLs [3] and/or COM scriptlets (SCT) from remote servers. [4] [5] [6] This execution may also bypass AppLocker and other application control defenses since CMSTP.exe is a legitimate binary that may be signed by Microsoft.
CMSTP.exe can also be abused to Bypass User Account Control and execute arbitrary commands from a malicious INF through an auto-elevated COM interface. [3] [5] [6]
| ID | Name | Description |
|---|---|---|
| S1149 | CHIMNEYSWEEP |
CHIMNEYSWEEP can use CMSTP.exe to install a malicious Microsoft Connection Manager Profile.[7] |
| G0080 | Cobalt Group |
Cobalt Group has used the command |
| S1202 | LockBit 3.0 |
LockBit 3.0 can attempt a CMSTP UAC bypass if it does not have administrative privileges.[11] |
| G0069 | MuddyWater |
MuddyWater has used CMSTP.exe and a malicious INF to execute its POWERSTATS payload.[12] |
| ID | Mitigation | Description |
|---|---|---|
| M1042 | Disable or Remove Feature or Program |
CMSTP.exe may not be necessary within a given environment (unless using it for VPN connection installation). |
| M1038 | Execution Prevention |
Consider using application control configured to block execution of CMSTP.exe if it is not required for a given system or network to prevent potential misuse by adversaries. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0328 | Detection of Malicious Profile Installation via CMSTP.exe | AN0932 |
Execution of CMSTP.exe with arguments pointing to suspicious or remote INF/SCT/DLL payloads, optionally followed by outbound network connections to untrusted IPs, process injection via COM interfaces (CMSTPLUA, CMLUAUTIL), registry modifications registering malicious profiles, or creation of suspicious INF/DLL/SCT files prior to execution. |