{"id":"T1218.003","name":"CMSTP","url":"https://attack.mitre.org/techniques/T1218/003","tactics":["stealth"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0328","stix_id":"x-mitre-detection-strategy--c254ecff-c728-4de8-a0f8-e5ad5015aa32","name":"Detection of Malicious Profile Installation via CMSTP.exe","url":"https://attack.mitre.org/detectionstrategies/DET0328","analytics":[{"id":"AN0932","stix_id":"x-mitre-analytic--ae250934-772b-43a5-9a29-9cbd92972858","name":"Analytic 0932","description":"Execution of CMSTP.exe with arguments pointing to suspicious or remote INF/SCT/DLL payloads, optionally followed by outbound network connections to untrusted IPs, process injection via COM interfaces (CMSTPLUA, CMLUAUTIL), registry modifications registering malicious profiles, or creation of suspicious INF/DLL/SCT files prior to execution.","url":"https://attack.mitre.org/detectionstrategies/DET0328#AN0932","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"wineventlog-powershell"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=10","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=12","data_component":"DC0056","data_component_name":"Windows Registry Key Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","data_component":"DC0063","data_component_name":"Windows Registry Key Modification","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"INFPathRegex","description":"Regex for identifying suspicious INF files; adjust to suppress known safe profiles"},{"field":"ExternalIPAllowlist","description":"Domains or IP ranges allowed for CMSTP network connections"},{"field":"COMInterfaceGUIDs","description":"Set of auto-elevated COM interface GUIDs to flag (e.g., CMSTPLUA, CMLUAUTIL)"},{"field":"RegistryKeyAllowlist","description":"Known good registry entries for CMSTP profile registration"},{"field":"TimeWindow","description":"Correlate CMSTP execution with subsequent network activity or process creation within N seconds"}],"live":true,"detection_strategies":["DET0328"],"techniques":["T1218.003"]}],"live":true,"version":"1.0","techniques":["T1218.003"]}],"sigma_rules":[{"id":"3b4b232a-af90-427c-a22f-30b0c0837b95","title":"CMSTP Execution Process Access","author":"Nik Seetharaman","status":"stable","level":"high","date":"2018-07-16","modified":"2021-06-27","description":"Detects various indicators of Microsoft Connection Manager Profile Installer execution","references":["https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/"],"logsource":{"product":"windows","category":"process_access"},"tags":["attack.stealth","attack.t1218.003","attack.execution","attack.t1559.001","attack.g0069","attack.g0080","car.2019-04-001"],"path":"rules/windows/process_access/proc_access_win_cmstp_execution_by_access.yml","techniques":["T1218.003","T1559.001"],"cves":[]},{"id":"4b60e6f2-bf39-47b4-b4ea-398e33cfe253","title":"CMSTP UAC Bypass via COM Object Access","author":"Nik Seetharaman, Christian Burkard (Nextron Systems)","status":"stable","level":"high","date":"2019-07-31","modified":"2024-12-01","description":"Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects (e.g. UACMe ID of 41, 43, 58 or 65)","references":["https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/","https://twitter.com/hFireF0X/status/897640081053364225","https://medium.com/falconforce/falconfriday-detecting-uac-bypasses-0xff16-86c2a9107abf","https://github.com/hfiref0x/UACME"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.privilege-escalation","attack.stealth","attack.t1548.002","attack.t1218.003","attack.g0069","car.2019-04-001"],"path":"rules/windows/process_creation/proc_creation_win_uac_bypass_cmstp_com_object_access.yml","techniques":["T1548.002","T1218.003"],"cves":[]},{"id":"75e508f7-932d-4ebc-af77-269237a84ce1","title":"DLL Loaded From Suspicious Location Via Cmspt.EXE","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-08-30","modified":"2023-02-17","description":"Detects cmstp loading \"dll\" or \"ocx\" files from suspicious locations","references":["https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/TTPs/Defense%20Evasion/T1218%20-%20Signed%20Binary%20Proxy%20Execution/T1218.003%20-%20CMSTP/Procedures.yaml"],"logsource":{"product":"windows","category":"image_load"},"tags":["attack.stealth","attack.t1218.003"],"path":"rules/windows/image_load/image_load_cmstp_load_dll_from_susp_location.yml","techniques":["T1218.003"],"cves":[]},{"id":"7d4cdc5a-0076-40ca-aac8-f7e714570e47","title":"CMSTP Execution Process Creation","author":"Nik Seetharaman","status":"stable","level":"high","date":"2018-07-16","modified":"2020-12-23","description":"Detects various indicators of Microsoft Connection Manager Profile Installer execution","references":["https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1218.003","attack.g0069","car.2019-04-001"],"path":"rules/windows/process_creation/proc_creation_win_cmstp_execution_by_creation.yml","techniques":["T1218.003"],"cves":[]},{"id":"b6d235fc-1d38-4b12-adbe-325f06728f37","title":"CMSTP Execution Registry Event","author":"Nik Seetharaman","status":"stable","level":"high","date":"2018-07-16","modified":"2020-12-23","description":"Detects various indicators of Microsoft Connection Manager Profile Installer execution","references":["https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/"],"logsource":{"product":"windows","category":"registry_event"},"tags":["attack.execution","attack.stealth","attack.t1218.003","attack.g0069","car.2019-04-001"],"path":"rules/windows/registry/registry_event/registry_event_cmstp_execution_by_registry.yml","techniques":["T1218.003"],"cves":[]},{"id":"e66779cc-383e-4224-a3a4-267eeb585c40","title":"Bypass UAC via CMSTP","author":"E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community","status":"test","level":"high","date":"2019-10-24","modified":"2022-08-30","description":"Detect commandline usage of Microsoft Connection Manager Profile Installer (cmstp.exe) to install specially formatted local .INF files","references":["https://eqllib.readthedocs.io/en/latest/analytics/e584f1a1-c303-4885-8a66-21360c90995b.html","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.003/T1218.003.md","https://lolbas-project.github.io/lolbas/Binaries/Cmstp/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1548.002","attack.t1218.003"],"path":"rules/windows/process_creation/proc_creation_win_uac_bypass_cmstp.yml","techniques":["T1548.002","T1218.003"],"cves":[]},{"id":"efafe0bf-4238-479e-af8f-797bd3490d2d","title":"Outbound Network Connection Initiated By Cmstp.EXE","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-08-30","modified":"2024-05-31","description":"Detects a network connection initiated by Cmstp.EXE\nIts uncommon for \"cmstp.exe\" to initiate an outbound network connection. Investigate the source of such requests to determine if they are malicious.\n","references":["https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/"],"logsource":{"product":"windows","category":"network_connection"},"tags":["attack.stealth","attack.t1218.003"],"path":"rules/windows/network_connection/net_connection_win_cmstp_initiated_connection.yml","techniques":["T1218.003"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}