T1216.001Stealth
PubPrn
Adversaries may use PubPrn to proxy execution of malicious remote files. PubPrn.vbs is a Visual Basic script that publishes a printer to Active Directory Domain Services. The script may be signed by Microsoft and is commonly executed through the Windows Command Shell via Cscript.exe. For example, the following code publishes a printer within the specified domain: cscript pubprn Printer1…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
2 Sigma rules tagged T1216.001PubPrnT1216.0012 general rules
- Launch-VsDevShell.PS1 Proxy Executionmediumtest
- Pubprn.vbs Proxy Executionmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to PubPrn
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.