CMSTP

Hypothesis and description

CMSTP.exe is the Microsoft Connection Manager Profile Installer, which can be leveraged to setup listeners that will receive and install malware from remote sources in trusted fashion.

When CMSTP.exe is seen in combination with an external connection, it is a good indication of this TTP.

Platforms: Windows
Domain: Host
Subtypes: Process
Submitted: 2020-11-30
Contributors: Olaf Hartong, MITRE

ATT&CK coverage

Technique	Tactics	Coverage
T1218 System Binary Proxy ExecutionT1218.003	Stealth (formerly Defense Evasion)	High

1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

T1218System Binary Proxy Execution
.003 CMSTP

D3FEND techniques MITRE maps to this analytic

D3-PSA Process Spawn Analysis

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

Pseudocode and implementations

PseudocodePseudocode - CMSTPData model: CAR native

This is a pseudocode representation of the below splunk search.

processes = search Process:Create
target_processes = filter processes where (
  exe="C:\Windows\System32\CMSTP.exe" AND
  src_ip NOT IN [10.0.0.0/8,192.168.0.0/16, 172.16.0.0/12] )
output target_processes

SplunkSplunk Search - CMSTPData model: Sysmon native

looks for instances of CMSTP.exe that are combined with external communication

(index=__your_sysmon_index__ EventCode=3) Image="C:\\Windows\\System32\\CMSTP.exe" | where ((!cidrmatch("10.0.0.0/8", SourceIp) AND !cidrmatch("192.168.0.0/16", SourceIp) AND !cidrmatch("172.16.0.0/12", SourceIp))

LogPointLogPoint Search - CMSTPData model: LogPoint native

looks for instances of CMSTP.exe that are combined with external communication

norm_id=WindowsSysmon event_id=3 image="C:\Windows\System32\CMSTP.exe" -source_address IN HOMENET

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

28 more in the full list

View CAR-2020-11-010 on car.mitre.org

Technique

Tactics

Coverage

T1218 System Binary Proxy ExecutionT1218.003

Stealth (formerly Defense Evasion)

High

Pseudocode and implementations

PseudocodePseudocode - CMSTPData model: CAR native

This is a pseudocode representation of the below splunk search.

processes = search Process:Create
target_processes = filter processes where (
  exe="C:\Windows\System32\CMSTP.exe" AND
  src_ip NOT IN [10.0.0.0/8,192.168.0.0/16, 172.16.0.0/12] )
output target_processes

SplunkSplunk Search - CMSTPData model: Sysmon native

looks for instances of CMSTP.exe that are combined with external communication

(index=__your_sysmon_index__ EventCode=3) Image="C:\\Windows\\System32\\CMSTP.exe" | where ((!cidrmatch("10.0.0.0/8", SourceIp) AND !cidrmatch("192.168.0.0/16", SourceIp) AND !cidrmatch("172.16.0.0/12", SourceIp))

LogPointLogPoint Search - CMSTPData model: LogPoint native

looks for instances of CMSTP.exe that are combined with external communication

norm_id=WindowsSysmon event_id=3 image="C:\Windows\System32\CMSTP.exe" -source_address IN HOMENET