PubPrn.vbs is a Visual Basic script that publishes a printer to Active Directory Domain Services. It may be signed by Microsoft and is commonly run through Cscript.exe. MITRE ATT&CK tracks its abuse as T1216.001, PubPrn, under System Script Proxy Execution in the Stealth tactic. The platform is Windows.
How attackers use it
MITRE describes adversaries setting the second parameter of the script to the script: moniker, pointing at a scriptlet file (.sct) hosted on a remote site. The signed script then fetches and runs the remote content. Because the script is signed, this can bypass signature validation and application control tools that do not account for it.
Newer Windows versions limit that parameter to LDAP://, which removes the remote proxying route. Older systems are the concern.
How to detect it
The MITRE detection strategy is specific: look for PubPrn.vbs executed through cscript.exe with the script: moniker loading a remote .sct file. Process creation logs with full command lines are the data you need. Sysmon event ID 1 or Windows Security event 4688 with command line auditing both work.
How to reduce the risk
- Use application control to block execution of this script if your environment does not need it.
- On Windows 10, update Windows Defender Application Control policies to include rules that block the older, vulnerable versions of PubPrn.
Quick check
What change in newer Windows versions limits this abuse?
PubPrn.vbs now restricts the second parameter to the LDAP:// protocol instead of allowing the script: moniker that could reference code over HTTP or HTTPS.
Sources
- MITRE ATT&CK, T1216.001: https://attack.mitre.org/techniques/T1216/001
