CMSTP INF execution
cmstp.exe installing a connection-manager profile from a caller-supplied INF or INI file.
What it detects
cmstp.exe installing a connection-manager profile from a caller-supplied INF or INI file.
CMSTP is auto-elevating and its profile format has a RunPreSetupCommands section, so a crafted INF is simply a list of commands that CMSTP executes for the attacker — elevated, from a signed Microsoft binary, with no consent prompt. /au performs the install silently, which is the flag the technique depends on.
Genuine connection-manager profiles are deployed by an administrator from a managed location, not from a temporary file that was written moments earlier.
MITRE ATT&CK mapping
False positives and triage
Organisations that still deploy dial-up or legacy VPN connection profiles use CMSTP legitimately, and those deployments are scripted — so expect a small, regular, predictable volume from a management account if that applies to you.
To confirm: read the INF/INI path. A file under \Temp\, \AppData\, or with a random name is the finding; a profile on a software-distribution share is probably genuine. Recover the file and read its RunPreSetupCommands — that section names exactly what was executed, which is the evidence worth preserving before the temporary file is cleaned up.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 85%. Source: rules/windows/cmstp_inf_execution.yaml, licensed under the Apache License 2.0.
id: windows.privilege_escalation.cmstp_inf_execution
version: 1.0.0
status: stable
severity: high
confidence: 0.85
platforms: [windows]
mitre_techniques: [T1218.003, T1548.002]
description: |
`cmstp.exe` installing a connection-manager profile from a caller-supplied INF or
INI file.
CMSTP is auto-elevating and its profile format has a `RunPreSetupCommands` section,
so a crafted INF is simply a list of commands that CMSTP executes for the attacker —
elevated, from a signed Microsoft binary, with no consent prompt. `/au` performs the
install silently, which is the flag the technique depends on.
Genuine connection-manager profiles are deployed by an administrator from a managed
location, not from a temporary file that was written moments earlier.
match:
process_name_contains_any: [cmstp]
command_line_regex: '(?i)/(au|ni|s)\b'
correlation_keys: [hostname, user_name]
false_positive_guidance: |
Organisations that still deploy dial-up or legacy VPN connection profiles use CMSTP
legitimately, and those deployments are scripted — so expect a small, regular,
predictable volume from a management account if that applies to you.
To confirm: read the INF/INI path. A file under `\Temp\`, `\AppData\`, or with a
random name is the finding; a profile on a software-distribution share is probably
genuine. Recover the file and read its `RunPreSetupCommands` — that section names
exactly what was executed, which is the evidence worth preserving before the
temporary file is cleaned up.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.