PT Network Attack Discovery

Helps reconstruct the attack timeline and understand the sources and scale of threats

Technique on mitre.org

T1216: System Script Proxy Execution

Adversaries may use trusted scripts, often signed with certificates, to proxy the execution of malicious files. Several Microsoft signed scripts that have been downloaded from Microsoft or are default on Windows installations can be used to proxy execution of other files. This behavior may be abused by adversaries to execute malicious files that could bypass application control and signature validation on systems.

Positive Technologies products that cover the technique

Detection

PT NAD can detect, using rules and filters, artifacts of downloading and remote executing malicious files via abuse of the PubPrn.vbs script functionality.

Example of PT NAD detection rules

ATTACK [PTsecurity] WScript.Shell Run HTML Code Execution Attempt (sid 10003456)

Examples of PT NAD filters

files.filename ~ "*.sct"

Subtechniques

T1216.001 PubPrn

Detection

ID	DS0017	Data source and component	Command: Command Execution	Description	Monitor executed commands and arguments for scripts like PubPrn.vbs that may be used to proxy execution of malicious files.

ID	DS0009	Data source and component	Process: Process Creation	Description	Monitor script processes, such as `cscript that may be used to proxy execution of malicious files.

ID	DS0012	Data source and component	Script: Script Execution	Description	Monitor for any attempts to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.

ID	Data source and component	Description
DS0017	Command: Command Execution	Monitor executed commands and arguments for scripts like PubPrn.vbs that may be used to proxy execution of malicious files.
DS0009	Process: Process Creation	Monitor script processes, such as `cscript that may be used to proxy execution of malicious files.
DS0012	Script: Script Execution	Monitor for any attempts to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.

Mitigation

ID	M1038	Name	Execution Prevention	Description	Certain signed scripts that can be used to execute other programs may not be necessary within a given environment. Use application control configured to block execution of these scripts if they are not required for a given system or network to prevent potential misuse by adversaries.

ID	Name	Description
M1038	Execution Prevention	Certain signed scripts that can be used to execute other programs may not be necessary within a given environment. Use application control configured to block execution of these scripts if they are not required for a given system or network to prevent potential misuse by adversaries.