T1218.003Stealth
CMSTP
Adversaries may abuse CMSTP to proxy execution of malicious code. The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections. Adversaries may supply CMSTP.exe with INF…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
7 Sigma rules tagged T1218.003CMSTPT1218.0037 general rules
- CMSTP App Paths Registry Key Modificationhighstable
- CMSTP Execution Process Accesshighstable
- CMSTP Execution Process Creationhighstable
- CMSTP UAC Bypass via COM Object Accesshighstable
- Bypass UAC via CMSTPhightest
- DLL Loaded From Suspicious Location Via Cmspt.EXEhightest
- Outbound Network Connection Initiated By Cmstp.EXEhightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to CMSTP
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.