Automation · API / MCP 中文

Technique note · T1191

CMSTP

The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections. Adversaries may supply CMSTP.exe with INF files infected with malicious commands. Similar to Regsvr32 / ”Squiblydoo”, CMSTP.exe may be abused to load and execute DLLs and/or COM scriptlets (SCT) from remote servers. This execution may also bypass AppLocker and other whitelisting defenses since CMSTP.exe is a legitimate, signed Microsoft application. CMSTP.exe can also be abused to Bypass User Account Control and execute arbitrary commands from a malicious INF through an auto-elevated COM interface.

ATT&CK T1191 platforms — Status Active Version 20.1

The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. 1 CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections. Adversaries may supply CMSTP.exe with INF files infected with malicious commands. 2 Similar to Regsvr32 / ”Squiblydoo”, CMSTP.exe may be abused to load and execute DLLs 3 and/or COM scriptlets (SCT) from remote servers. 4 5 6 This execution may also bypass AppLocker and other whitelisting defenses since CMSTP.exe is a legitimate, signed Microsoft application. CMSTP.exe can also be abused to Bypass User Account Control and execute arbitrary commands from a malicious INF through an auto-elevated COM interface. 7 8 9

  1. Microsoft Connection Manager Oct 2009
  2. Twitter CMSTP Usage Jan 2018
  3. MSitPros CMSTP Aug 2017
  4. Twitter CMSTP Jan 2018
  5. GitHub Ultimate AppLocker Bypass List
  6. Endurant CMSTP July 2018
  7. MSitPros CMSTP Aug 2017
  8. GitHub Ultimate AppLocker Bypass List
  9. Endurant CMSTP July 2018

Groups using this technique

No group use in the reference set yet.

Claims

No public claim points at this technique yet.

Auto-ingested and not human-reviewed; confidence and validity read by citation.