T1218.003 — CMSTP

Tactic: Stealth · Platforms: Windows

Adversaries may abuse CMSTP to proxy execution of malicious code. The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. CMSTP.exe accepts an installation information file (INF) as a parameter and installs a…

Sub-technique of System Binary Proxy Execution (T1218).

Sigma detection rules (1)

T1218.003 System Binary Proxy Execution: CMSTP

title: "T1218.003 System Binary Proxy Execution: CMSTP"
id: c96e96fd-a357-4f01-b6f8-e1ca88ecdef7
description: 'Detection of Malicious Profile Installation via CMSTP.exe. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: INFPathRegex, ExternalIPAllowlist, COMInterfaceGUIDs, RegistryKeyAllowlist, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1218/003
author: Shahrukh Khan
date: 2026-04-20
license: MIT
tags:
  - attack.stealth
  - attack.t1218.003

logsource:
  category: process_creation
  product: windows

detection:
  selection:
    EventID: '1'
    Image|endswith: '\cmstp.exe'
    CommandLine|contains: '.inf'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Legitimate Connection Manager profile installation by IT staff.

level: medium

Related sub-techniques

Explore