# T1218.003 CMSTP

> As of 2026-11-14, T1218.003 (CMSTP) appears in 10 tracked threats, first reported 2026-03-01 and most recently 2026-11-12, with linked actors including MuddyWater; it most often appears alongside T1059.001 (PowerShell).

- **Tracked threats:** 10 (1 critical, 9 high)
- **First seen:** 2026-03-01
- **Last seen:** 2026-11-12
- **Threat actors:** 1
- **Detection rules:** 14 (counts only; unlock with TL Creds)

## Key facts

- **ID:** T1218.003
- **Framework:** MITRE ATT&CK
- **Tactics:** Stealth (formerly Defense Evasion)
- **Matrix:** Enterprise
- **Parent:** T1218
- **Data as of:** 2026-11-14
- **MITRE:** https://attack.mitre.org/techniques/T1218/003/

## Activity timeline

T1218.003 first appeared in tracked threats on 2026-03-01 and was most recently reported on 2026-11-12. The busiest month was 2026-10 with 3 reports, and 10 of the 10 threats were reported in the twelve months to 2026-11.

## How adversaries use it

T1218.003 CMSTP is catalogued by MITRE ATT&CK under the Stealth (formerly Defense Evasion) tactic in the Enterprise matrix, as a sub-technique of [T1218 System Binary Proxy Execution](https://intel.threadlinqs.com/technique/T1218). Threadlinqs maps 10 of 3938 tracked threats (0.3%) to it; by severity that is 1 critical, 9 high.

Threats that use T1218.003 most often also use [T1059.001 PowerShell](https://intel.threadlinqs.com/technique/T1059.001) (9 threats), [T1113 Screen Capture](https://intel.threadlinqs.com/technique/T1113) (8 threats), [T1204.002 Malicious File](https://intel.threadlinqs.com/technique/T1204.002) (8 threats), [T1547.001 Registry Run Keys / Startup Folder](https://intel.threadlinqs.com/technique/T1547.001) (8 threats), [T1685 Disable or Modify Tools](https://intel.threadlinqs.com/technique/T1685) (8 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

1 tracked threat actor appear in the threats that use T1218.003; the most frequent are [MuddyWater](https://intel.threadlinqs.com/actor/MuddyWater) (1).

## Mitigations

MITRE ATT&CK lists 2 mitigations for T1218.003.

- [M1038 Execution Prevention](https://attack.mitre.org/mitigations/M1038/)
- [M1042 Disable or Remove Feature or Program](https://attack.mitre.org/mitigations/M1042/)

## Data sources

Telemetry that can reveal T1218.003, per MITRE ATT&CK.

- Command — Command Execution
- Network Traffic — Network Connection Creation
- Process — Process Creation

## Threat actors using it

- [MuddyWater](https://intel.threadlinqs.com/actor/MuddyWater) — 1

## Tracked threats

10 tracked threats use T1218.003.

- [Operation Endgame: Europol takedown of Gootloader, CastleRAT and StealC infrastructure; 6M+ stolen…](https://intel.threadlinqs.com/threat/TL-2026-5862) — high — 2026-11-12
- [RevStealer Windows Infostealer (Elastic REF2859) Uses 14 Indirect Syscalls and EtherHiding C2 to Steal…](https://intel.threadlinqs.com/threat/TL-2026-5613) — high — 2026-11-10
- [Marsalek Malware-as-a-Service Hidden in Fake Roblox, Minecraft and Fortnite Cheats Delivers PureLog Stealer](https://intel.threadlinqs.com/threat/TL-2026-5393) — high — 2026-11-06
- [XWorm Leaked Builder Spawns Surveillance-Capable RAT Variants (V6.4, V6.5 'XWorm Reborn', V7.2, V7.4)](https://intel.threadlinqs.com/threat/TL-2026-3475) — high — 2026-10-14
- [XWorm RAT (V6.4-V7.4): Microphone Surveillance and Logged-In Browser Session Hijacking](https://intel.threadlinqs.com/threat/TL-2026-3434) — high — 2026-10-13
- [XWorm Reborn: Modular XWorm 6.x RAT Evolves from Infostealer to Surveillance and Extortion Platform (Netskope)](https://intel.threadlinqs.com/threat/TL-2026-3363) — high — 2026-10-12
- [DOUBLECUP ClickFix Loader-as-a-Service Hides Malware in Browser Cache Images via Steganography](https://intel.threadlinqs.com/threat/TL-2026-1847) — high — 2026-08-03
- [GST Refund Phishing Delivers Remcos RAT via Multi-Stage .NET Bitmap-Steganography Infection Chain](https://intel.threadlinqs.com/threat/TL-2026-1443) — high — 2026-07-17
- [Remcos RAT: Technical Analysis of Windows Remote Access Trojan Operations](https://intel.threadlinqs.com/threat/TL-2026-1133) — high — 2026-07-05
- [CHAR Rust Backdoor + GhostFetch/GhostBackDoor/HTTP_VIP — Iran MOIS-Linked MuddyWater AI-Assisted Malware…](https://intel.threadlinqs.com/threat/TL-2026-0160) — critical — 2026-03-01

## Detection coverage

Threadlinqs maintains 14 detection rules mapped to T1218.003 (SPL 4, KQL 5, Sigma 5). Rule content unlocks with TL Creds on a free account; this page shows counts only.

14 detection rules (SPL/KQL/Sigma), unlock with TL Creds: https://threadlinqs.com/tl-creds

## Parent technique

[T1218 System Binary Proxy Execution](https://intel.threadlinqs.com/technique/T1218) — 178 tracked threats at the technique level.

## Links

- Canonical page: https://intel.threadlinqs.com/technique/T1218.003
- All techniques: https://intel.threadlinqs.com/techniques
- Full detection coverage and IOCs unlock per threat with TL Creds (https://threadlinqs.com/tl-creds); MCP for AI agents (Purple): https://intel.threadlinqs.com/mcp