Remote scriptlet proxied through PubPrn.vbs

Siemphony@siemphonyhighT1216.001unverified

AN1464 describes a single command shape: the signed Microsoft printer publishing script pubprn.vbs run under a script host with its second argument set to the `script:` moniker, so that the script's GetObject call fetches and executes a remote .sct scriptlet instead of resolving an LDAP container. All three legs are required together — cscript.exe or wscript.exe as the image, `pubprn` somewhere in the command line, and a `script:` moniker carrying a remote location — because the documented legitimate invocation passes an `LDAP://` path as that argument and therefore never satisfies the third. MITRE's `CommandLineRegex` knob describes the moniker with an HTTP or HTTPS URI; the ftp and UNC spellings in that list were added here, not taken from the brief. Limits worth stating plainly. Both the image list and the `pubprn` string are defeated by copying the script under another name, and that is not a hypothetical evasion: Windows 10 and later ship a pubprn.vbs that refuses a remote second argument, so a match on a current build normally means a downlevel copy of the old script was carried onto the host, where renaming it costs the adversary nothing. The analytic's four other log sources are all correlation legs — the outbound fetch on Sysmon EventID 3 or 22, and the module load on EventID 7 that would in practice be the scriptlet runtime scrobj.dll, a name inferred here rather than given by MITRE — and none is attempted, because Sigma models no join between events and because the fetch is performed inside the script host process itself, so on its own it is an ordinary cscript.exe network connection rather than a detection. This rule is written in the Sysmon EventID 1 vocabulary (`Image`, `CommandLine`) that AN1464 names first; a process_creation index fed from Security 4688 instead needs `NewProcessName` mapped onto `Image`, and 4688 needs both *Audit Process Creation* and the separate *Include command line in process creation events* policy before `CommandLine` exists at all — neither is on in a default install or in the Microsoft and CIS baselines, and without them this rule returns zero rows, which reads as quiet when it means blind. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0528, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\cscript.exe" or FolderPath endswith "\\wscript.exe") and ProcessCommandLine contains "pubprn" and (ProcessCommandLine contains "script:http" or ProcessCommandLine contains "script:ftp" or ProcessCommandLine contains "script:\\\\"))

Splunk · SPL

Run this as a search.

index=* ((Image="*\\cscript.exe" OR Image="*\\wscript.exe") AND CommandLine="*pubprn*" AND (CommandLine="*script:http*" OR CommandLine="*script:ftp*" OR CommandLine="*script:\\\\*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\cscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wscript.exe") AND TO_LOWER(process.command_line) LIKE "*pubprn*" AND (TO_LOWER(process.command_line) LIKE "*script:http*" OR TO_LOWER(process.command_line) LIKE "*script:ftp*" OR TO_LOWER(process.command_line) LIKE "*script:\\\\\\\\*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\cscript\.exe$|\\wscript\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)pubprn</field>    <field name="CommandLine" type="pcre2">(?i)(script:http|script:ftp|script:\\\\)</field>    <description>Remote scriptlet proxied through PubPrn.vbs</description>    <mitre>      <id>T1216.001</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: high
Category: signed_binary_proxy
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 74a32afe-7f23-41cb-a088-6830b9cb5f24

ATT&CKT1216.001

T1216.001PubPrn

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonsigned binary proxy

signed binary proxyAI draft — unreviewed

01 · What this rule detects

pubprn.vbs is a Microsoft-signed VBScript that publishes a printer to Active Directory. It hands its second argument to GetObject, and GetObject accepts the script: moniker as readily as it accepts LDAP:// — point it at a remote .sct scriptlet and a signed Microsoft script executes adversary code. That is the bypass AN1464 describes. The rule catches one command shape: a script host running something called pubprn with a remote script: moniker on its command line.

02 · Telemetry you need

Sysmon EventID 1, the first log source AN1464 names, through the process_creation / windows logsource copied from the brief. The rule reads two fields only, Image and CommandLine. If your index is fed from Security 4688 instead, NewProcessName must be mapped onto Image first, and 4688 carries no command line at all until both Audit Process Creation and the separate Include command line in process creation events policy are enabled — neither is on in a default install or in the Microsoft and CIS baselines. Without them the rule returns zero rows, and zero rows reads as quiet when it means blind. AN1464's other four sources (Sysmon 3, 22 and 7, PowerShell 4103–4106) are correlation legs and go unused.

03 · How the logic works

Three selections, all required (all of selection_*). selection_script_host takes Image|endswith on \cscript.exe or \wscript.exe. selection_pubprn is a bare CommandLine|contains: 'pubprn' — no path, no extension — so the bare name, pubprn.vbs and the full Printing_Admin_Scripts path all satisfy it. selection_remote_moniker takes CommandLine|contains on script:http, script:ftp or script:\\ (written with four backslashes in the YAML, which is one literal pair, a UNC prefix). The third leg does the discriminating: the documented legitimate invocation passes an LDAP:// container path as that argument and can never satisfy it. MITRE's CommandLineRegex knob describes the moniker with an HTTP/HTTPS URI only — the ftp and UNC spellings are the pipeline's own additions.

04 · Common false positives

Barely at all, and that is a statement about scope rather than a boast. The two false positives on the rule name adversary-emulation platforms (Atomic Red Team and the canned equivalents in Caldera, AttackIQ, SafeBreach) and analysts reproducing the bypass on an instrumented host. Both are people running the attack deliberately. Review flagged that as one category written twice, and flagged the phrase "loudest source here by a wide margin" sitting beside level: high. Emulation runs are periodic and attributable rather than high-volume, so the level holds — but the wording argues against its own score. No benign business process matches this logic, because there is none.

05 · Detection maturity

tier_1: Lowest tier, and it stays there until someone runs it against real data. It is authored from a MITRE scaffold that ships no query logic, so it has no measured true-positive or false-positive rate. It renders in Sentinel KQL, Splunk SPL, Elastic ES|QL and Wazuh XML — that proves it parses, not that it fires. Generate the behaviour on an instrumented host, confirm the event lands with the fields the rule expects, then let it soak in your estate before trusting a hit.

Tuning & false positivesexperimental · 2 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Scope out the validation agent's account and your detection lab hosts; those are the only expected hits. Resist widening the pubprn string, because that leg is the real ceiling and loosening it does not fix what is wrong with it. Windows 10 and later ship a patched pubprn.vbs that refuses a remote second argument, so a match on a current build normally means a downlevel copy of the old script was carried onto the host — and an adversary already dropping files renames it for nothing. The identical script: fetch driven from any other .vbs walks past too. Closing that needs a separate rule on the moniker under a script host with no pubprn gate, which is parent T1216 / T1218.010 territory.

Declared by the author

Adversary-emulation and control-validation platforms. The Atomic Red Team test for this sub-technique, and the equivalent canned tests in Caldera, AttackIQ and SafeBreach, run this exact cscript pubprn.vbs script:http command line, so a scheduled validation campaign produces a byte-identical match on every host it touches. In an estate that runs continuous validation this is the loudest source here by a wide margin, and it is periodic and attributable rather than rare, so scope the rule away from the validation agent's account before treating a hit as an intrusion.
Detection engineering and incident response work on an instrumented host. An analyst reproducing the published bypass to confirm this rule fires, to test a WDAC or AppLocker policy, or to capture a sample for a malware report, generates the same process creation event with no adversary present. This is the most common single cause of a first alert from a newly deployed copy of this rule.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1216.001, evaluated against their process_creation events.

Share this rule

/u/siemphony/74a32afe-7f23-41cb-a088-6830b9cb5f24

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Remote scriptlet proxied through PubPrn.vbs

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it