From 46c810d29c29a16cb2bbe919603c6226c9df1db7 Mon Sep 17 00:00:00 2001
From: fornotes <125354166+fornotes@users.noreply.github.com>
Date: Wed, 17 Jul 2024 19:49:48 +0000
Subject: [PATCH] Update include_microsoft_cmstp.xml

CMSTP can execute .inf even without the /ni switch

https://www.ired.team/offensive-security/code-execution/t1191-cmstp-code-execution
---
 1_process_creation/include_microsoft_cmstp.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/1_process_creation/include_microsoft_cmstp.xml b/1_process_creation/include_microsoft_cmstp.xml
index 71c17b85..0d28d77d 100644
--- a/1_process_creation/include_microsoft_cmstp.xml
+++ b/1_process_creation/include_microsoft_cmstp.xml
@@ -4,7 +4,7 @@
       <ProcessCreate onmatch="include">
         <Rule name="CMSTP" groupRelation="and">
           <OriginalFileName name="technique_id=T1218.003,technique_name=CMSTP" condition="is">CMSTP.exe</OriginalFileName>          <!--Microsoft Connection Manager Profile Installer-->
-          <CommandLine name="technique_id=T1218.003,technique_name=CMSTP" condition="contains all">/ni;/s</CommandLine>
+          <CommandLine name="technique_id=T1218.003,technique_name=CMSTP" condition="contains any">/ni;/s</CommandLine>
         </Rule>
       </ProcessCreate>
     </RuleGroup>