Detection of CMSTP App Paths Registry Modification

Microsoft Connection Manager Profile Installer (CMSTP.exe) is a legitimate Windows binary designed to install Connection Manager service profiles. Threat actors frequently abuse this utility to execute arbitrary code or bypass UAC. The technique involves manipulating specific registry keys within the App Paths hive, which influences how the operating system handles execution requests or loads associated dynamic link libraries (DLLs). By modifying these registry paths, attackers can force CMSTP to load malicious DLLs or configuration files, facilitating execution in a higher-privileged context. This is a well-documented LOLBAS (Living Off the Land Binary and Script) technique that persists across modern Windows environments, requiring defenders to monitor registry modifications associated with CMSTP's configuration parameters.

Attack Chain

1. Attacker identifies a target system where CMSTP.exe execution is permissible.
2. Attacker prepares a malicious DLL or configuration profile (INF file) to be loaded by CMSTP.
3. Attacker gains sufficient privileges to modify the Windows registry.
4. Attacker performs a write operation to the registry key HKLM or HKCU under Software\Microsoft\Windows\CurrentVersion\App Paths\cmmgr32.exe.
5. Attacker executes cmstp.exe via command line or automated script.
6. CMSTP.exe references the modified App Paths registry key.
7. CMSTP.exe loads the attacker-supplied DLL or INF file, bypassing security controls or executing arbitrary logic.
8. Final objective is achieved, such as privilege escalation, persistence, or payload execution.

Impact

Successful abuse of this technique allows an attacker to execute code with elevated privileges, bypassing standard UAC protections. This facilitates further post-exploitation activities, including credential dumping, lateral movement, or the deployment of ransomware within an organization.

Recommendation

1. Deploy the provided Sigma rule to monitor registry modifications targeting cmmgr32.exe App Paths.
2. Alert on any write operations to the registry path SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\cmmgr32.exe\ that are not associated with authorized system updates.
3. Utilize Sysmon or native Windows Registry auditing to capture the process ID responsible for the registry change, ensuring attribution back to the parent process.