自动化接入 · API / MCP EN

技术说明 · T1218.003

CMSTP

Adversaries may abuse CMSTP to proxy execution of malicious code. The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections. Adversaries may supply CMSTP.exe with INF files infected with malicious commands. Similar to Regsvr32 / ”Squiblydoo”, CMSTP.exe may be abused to load and execute DLLs and/or COM scriptlets (SCT) from remote servers. This execution may also bypass AppLocker and other application control defenses since CMSTP.exe is a legitimate binary that may be signed by Microsoft. CMSTP.exe can also be abused to Bypass User Account Control and execute arbitrary commands from a malicious INF through an auto-elevated COM interface.

ATT&CK T1218.003 platforms — 状态 有效 版本 20.1

Adversaries may abuse CMSTP to proxy execution of malicious code. The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles.1 CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections. Adversaries may supply CMSTP.exe with INF files infected with malicious commands.2 Similar to Regsvr32 / ”Squiblydoo”, CMSTP.exe may be abused to load and execute DLLs3 and/or COM scriptlets (SCT) from remote servers.456 This execution may also bypass AppLocker and other application control defenses since CMSTP.exe is a legitimate binary that may be signed by Microsoft. CMSTP.exe can also be abused to Bypass User Account Control and execute arbitrary commands from a malicious INF through an auto-elevated COM interface.789

  1. Microsoft Connection Manager Oct 2009
  2. Twitter CMSTP Usage Jan 2018
  3. MSitPros CMSTP Aug 2017
  4. Twitter CMSTP Jan 2018
  5. GitHub Ultimate AppLocker Bypass List
  6. Endurant CMSTP July 2018
  7. MSitPros CMSTP Aug 2017
  8. GitHub Ultimate AppLocker Bypass List
  9. Endurant CMSTP July 2018

使用该技术的组织

组织名称国家
grp_g0080Cobalt Group—
grp_g0069MuddyWater—

断言

尚无指向该技术的公开断言。

记录自动入库·未人工复核；置信度与有效期按引用读取。