BIOC
Low
✕
Microsoft Connection Manager Profile Installer makes connections to the network
The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. CMSTP.exe may be abused to load and execute DLLs and/or COM scriptlets (SCT) from remote servers. This execution may also bypass AppLocker and other whitelisting defenses since CMSTP.exe is a legitimate, signed Microsoft application.
- Module:
- Platform Analytics
- Agent event type:
- Network
- Category:
- Dropper
- Status:
- Enabled
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: System Binary Proxy Execution: CMSTP (T1218.003)
Indicator:
Network action type = outgoing , failed Process initiated by = CMSTP.exe
Preventable: yes