chore: update dcfor pattern to use outboundwithdepth for optional gro…

…up membership
SpecterOps · Jan 30, 2024 · 1e2f3b5 · 1e2f3b5
1 parent 67d55f8
commit 1e2f3b5
Showing 1 changed file with 6 additions and 6 deletions.
diff --git a/packages/go/analysis/ad/ad.go b/packages/go/analysis/ad/ad.go
@@ -718,15 +718,15 @@ func ADCSESC6aPath3Pattern(domainId graph.ID, enterpriseCAs, candidateTemplates
 
 func ADCSESC6aPath4Pattern(domainId graph.ID, enterpriseCAs cardinality.Duplex[uint32]) traversal.PatternContinuation {
 	return traversal.NewPattern().
-		Outbound(query.Or(
+		Outbound(
 			query.And(
 				query.Kind(query.Relationship(), ad.MemberOf),
 				query.Kind(query.End(), ad.Group),
-			),
-			query.And(
-				query.KindIn(query.Relationship(), ad.Enroll),
-				query.KindIn(query.End(), ad.EnterpriseCA),
-				query.InIDs(query.End(), cardinality.DuplexToGraphIDs(enterpriseCAs)...)),
+			)).
+		Outbound(query.And(
+			query.KindIn(query.Relationship(), ad.Enroll),
+			query.KindIn(query.End(), ad.EnterpriseCA),
+			query.InIDs(query.End(), cardinality.DuplexToGraphIDs(enterpriseCAs)...),
 		)).
 		Outbound(query.And(
 			query.KindIn(query.Relationship(), ad.CanAbuseWeakCertBinding),