System Binary Proxy Execution: CMSTP
- ID
- T1218.003
- Tactics
- TA0005 Stealth
- Sub-technique of
- T1218 System Binary Proxy Execution
- Platforms
- Windows
- Data sources
- Command Execution, Network Connection Creation, Process Creation, Process Access, Windows Registry Key Creation, Windows Registry Key Modification, File Creation
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
Adversaries may abuse CMSTP to proxy execution of malicious code. The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. [1] CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections.
Adversaries may supply CMSTP.exe with INF files infected with malicious commands. [2] Similar to Regsvr32 / ”Squiblydoo”, CMSTP.exe may be abused to load and execute DLLs [3] and/or COM scriptlets (SCT) from remote servers. [4] [5] [6] This execution may also bypass AppLocker and other application control defenses since CMSTP.exe is a legitimate binary that may be signed by Microsoft.
CMSTP.exe can also be abused to Bypass User Account Control and execute arbitrary commands from a malicious INF through an auto-elevated COM interface. [3] [5] [6]
Detection
- DET0328 Detection of Malicious Profile Installation via CMSTP.exe
Data components: Command Execution, Network Connection Creation, Process Creation, Process Access, Windows Registry Key Creation, Windows Registry Key Modification, File Creation
Mitigations (2)
- M1038 Execution Prevention
Consider using application control configured to block execution of CMSTP.exe if it is not required for a given system or network to prevent potential misuse by adversaries.
- M1042 Disable or Remove Feature or Program
CMSTP.exe may not be necessary within a given environment (unless using it for VPN connection installation).