2 parents b1a8fdd + 46c810d commit 7d4d42bCopy full SHA for 7d4d42b
1 file changed
1_process_creation/include_microsoft_cmstp.xml
@@ -4,7 +4,7 @@
4
<ProcessCreate onmatch="include">
5
<Rule name="CMSTP" groupRelation="and">
6
<OriginalFileName name="technique_id=T1218.003,technique_name=CMSTP" condition="is">CMSTP.exe</OriginalFileName> <!--Microsoft Connection Manager Profile Installer-->
7
- <CommandLine name="technique_id=T1218.003,technique_name=CMSTP" condition="contains all">/ni;/s</CommandLine>
+ <CommandLine name="technique_id=T1218.003,technique_name=CMSTP" condition="contains any">/ni;/s</CommandLine>
8
</Rule>
9
</ProcessCreate>
10
</RuleGroup>
0 commit comments