BIOC
Low
✕
Microsoft Connection Manager Profile Installer runs command line or PowerShell
The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. CMSTP.exe may be abused to load and execute DLLs and/or COM scriptlets (SCT) from remote servers. This execution may also bypass AppLocker and other whitelisting defenses since CMSTP.exe is a legitimate, signed Microsoft application.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Execution
- Status:
- Enabled
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: System Binary Proxy Execution: CMSTP (T1218.003)
Indicator:
Process action type = execution AND target process name = powershell.exe , cmd.exe Process initiated by = CMSTP.exe
Preventable: yes