The Microsoft Connection Manager Profile Installer, CMSTP.exe, installs Connection Manager service profiles used for remote access connections. MITRE ATT&CK tracks its abuse as T1218.003, CMSTP, a System Binary Proxy Execution sub-technique in the Stealth tactic. The platform is Windows.
How attackers use it
CMSTP.exe takes an installation information (INF) file as a parameter. MITRE says adversaries may supply INF files containing malicious commands. Like Regsvr32 and its Squiblydoo variant, CMSTP.exe may be abused to load and execute DLLs or COM scriptlets from remote servers. Because it is a legitimate binary that may be signed by Microsoft, it can also bypass AppLocker and other application control defenses.
There is a second use. CMSTP.exe can be abused to bypass User Account Control and run arbitrary commands from a malicious INF through an auto-elevated COM interface.
How to detect it
The MITRE strategy points at CMSTP.exe launched with arguments pointing to suspicious or remote INF, SCT or DLL payloads. Supporting signals include:
- Outbound network connections to untrusted addresses
- Process injection through the CMSTPLUA and CMLUAUTIL COM interfaces
- Registry changes registering malicious profiles
- Creation of INF, DLL or SCT files just before execution
Command line logging and file creation events are the foundation. Sysmon event IDs 1, 3, 11 and 13 map to process creation, network, file creation and registry writes.
If you use CMSTP for VPN profile installs, build a baseline of the INF paths your own tooling uses, and alert on everything else.
How to reduce the risk
- Block CMSTP.exe with application control if it is not required.
- Disable or remove it where it is not needed. MITRE notes the exception, which is when it is used for VPN connection installation.
Check your own environment
- Do you use Connection Manager profiles at all?
- Is there any legitimate reason for CMSTP.exe to reach the internet?
- Are INF files allowed from user writable folders?
This read-only PowerShell command lists recent process creation events from the Security log, if command line auditing is enabled. Filter the output for cmstp.
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} -MaxEvents 200 | Where-Object { $_.Message -match 'cmstp' } | Select-Object TimeCreated, Message
Where to start
Find out whether anyone in your company still uses Connection Manager profiles. If the answer is no, block CMSTP.exe with application control and add an alert for any attempt to run it. If the answer is yes, find the one team and the one packaging path that use it, restrict the rule to that scope and treat every other run, especially one that touches the network, as worth investigating.
Quick check
What two outcomes does MITRE describe for abusing CMSTP.exe?
Loading and running DLLs or COM scriptlets from remote servers, and bypassing User Account Control through an auto-elevated COM interface.
Sources
- MITRE ATT&CK, T1218.003: https://attack.mitre.org/techniques/T1218/003
