Adversaries may abuse CMSTP to proxy execution of malicious code. The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. (Citation: Microsoft Connection Manager Oct 2009) CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections.

Adversaries may supply CMSTP.exe with INF files infected with malicious commands. (Citation: Twitter CMSTP Usage Jan 2018) Similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010) / ”Squiblydoo”, CMSTP.exe may be abused to load and execute DLLs (Citation: MSitPros CMSTP Aug 2017)  and/or COM scriptlets (SCT) from remote servers. (Citation: Twitter CMSTP Jan 2018) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018) This execution may also bypass AppLocker and other application control defenses since CMSTP.exe is a legitimate binary that may be signed by Microsoft.

CMSTP.exe can also be abused to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002) and execute arbitrary commands from a malicious INF through an auto-elevated COM interface. (Citation: MSitPros CMSTP Aug 2017) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018)
CMSTP
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1218/003  external_id: T1218.003     source_name: Twitter CMSTP Usage Jan 2018  description: Carr, N. (2018, January 31). Here is some early bad cmstp.exe... Retrieved April 11, 2018.  url: https://twitter.com/ItsReallyNick/status/958789644165894146     source_name: Microsoft Connection Manager Oct 2009  description: Microsoft. (2009, October 8). How Connection Manager Works. Retrieved April 11, 2018.  url: https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2003/cc786431(v=ws.10)     source_name: MSitPros CMSTP Aug 2017  description: Moe, O. (2017, August 15). Research on CMSTP.exe. Retrieved April 11, 2018.  url: https://msitpros.com/?p=3960     source_name: GitHub Ultimate AppLocker Bypass List  description: Moe, O. (2018, March 1). Ultimate AppLocker Bypass List. Retrieved April 10, 2018.  url: https://github.com/api0cradle/UltimateAppLockerByPassList     source_name: Endurant CMSTP July 2018  description: Seetharaman, N. (2018, July 7). Detecting CMSTP-Enabled Code Execution and UAC Bypass With Sysmon.. Retrieved August 6, 2018.  url: http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/     source_name: Twitter CMSTP Jan 2018  description: Tyrer, N. (2018, January 30). CMSTP.exe - remote .sct execution applocker bypass. Retrieved April 11, 2018.  url: https://twitter.com/NickTyrer/status/958450014111633408     