T1218.003 System Binary Proxy Execution: CMSTP

Adversaries may abuse CMSTP to proxy execution of malicious code. MITRE ATT&CK

1 program on CmdID 1 Sigma rule T1218.003 on attack.mitre.org

Part of

MITRE ATT&CK

T1218System Binary Proxy Execution

documented by LOLBAS and GTFOBins, or named by its rules

process creation, the highest levels first

highBypass UAC via CMSTPE.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community · Windows

everyday examples from tldr-pages, CC BY 4.0

Install without checking for dependencies on the page for cmstp.exe

cmstp /nf "path\to\profile_file"Identify

An example is here when CmdID’s reading of it names T1218.003: a Sigma rule it trips is tagged with it, or its abuse is documented as it.