PubPrn

PubPrn [T1216.001]

Information

• Name: PubPrn

• ID: T1216.001

• Tactics: TA0005

• Technique: T1216

Introduction

PubPrn (T1216.001) is a sub-technique within the MITRE ATT&CK framework under the broader parent technique "Signed Script Proxy Execution." Attackers exploit the legitimate Microsoft-signed binary "pubprn.vbs," a Visual Basic script designed for printer management, to bypass application control and execute unauthorized scripts or commands. Since this script is signed and trusted by default within Windows environments, adversaries leverage it to evade detection and execute malicious payloads while appearing legitimate.

Deep Dive Into Technique

PubPrn involves the abuse of a legitimate, Microsoft-signed Visual Basic script (pubprn.vbs) commonly found in Windows operating systems. This script is typically located at:

C:\Windows\System32\Printing_Admin_Scripts\en-US\pubprn.vbs

Attackers exploit the script's ability to execute arbitrary commands or scripts by passing malicious parameters. Since pubprn.vbs is legitimately signed by Microsoft, it is often permitted by application control solutions and antivirus software, allowing attackers to bypass security measures.

Technical details of execution methods include:

• Attackers invoke pubprn.vbs via command-line interfaces (cmd.exe, PowerShell).

• Malicious actors use the script's built-in functionality to execute arbitrary commands or scripts, typically by abusing parameters such as /s, /p, and /u.

• Commonly used command syntax for malicious purposes:

  cscript.exe C:\Windows\System32\Printing_Admin_Scripts\en-US\pubprn.vbs <malicious parameters>

• Attackers may use pubprn.vbs to download and execute payloads, establish persistence, or escalate privileges.

Real-world adversaries utilize this technique for:

• Bypassing application whitelisting or application control solutions.

• Executing malicious scripts or payloads without detection by endpoint security tools.

• Gaining initial access or establishing persistence in compromised environments.

When this Technique is Usually Used

This sub-technique typically appears in various attack scenarios and stages, including:

• Initial Access: Attackers may leverage pubprn.vbs to execute malicious payloads after initial compromise via phishing or exploitation.

• Execution: Commonly employed to execute arbitrary scripts or commands on compromised systems.

• Defense Evasion: Used to bypass application control solutions, antivirus, endpoint detection and response (EDR), and other security controls.

• Persistence and Privilege Escalation: Attackers may use pubprn.vbs scripts to maintain persistence or escalate privileges by executing malicious scripts or commands at elevated privileges.

Attack scenarios include:

• Spear-phishing campaigns delivering malicious attachments or links that invoke pubprn.vbs.

• Post-exploitation stages where attackers seek to evade detection and execute commands stealthily.

• Advanced Persistent Threat (APT) operations seeking covert execution paths in targeted environments.

How this Technique is Usually Detected

Detection of PubPrn abuse typically involves monitoring specific execution patterns, command-line arguments, and behavioral anomalies:

• Process Monitoring:

  • Monitor execution of cscript.exe or wscript.exe with unusual or suspicious parameters.

  • Track invocation of scripts located in C:\Windows\System32\Printing_Admin_Scripts\en-US\pubprn.vbs.

• Command-line Analysis:

  • Identify abnormal command-line parameters passed to pubprn.vbs.

  • Detect execution of pubprn.vbs scripts from unusual directories or contexts.

• Endpoint Detection and Response (EDR):

  • Utilize EDR solutions to detect anomalous script execution patterns.

  • Leverage behavioral analytics to identify unusual process hierarchies associated with pubprn.vbs.

• Application Control and Whitelisting:

  • Implement strict application control policies to restrict execution of scripts from specific directories.

  • Monitor and alert on any deviations from approved execution paths.

Indicators of Compromise (IoCs) include:

• Suspicious command-line arguments invoking pubprn.vbs.

• Unexpected network connections originating from scripts executed via pubprn.vbs.

• Unusual file creations or modifications following the execution of pubprn.vbs.

Why it is Important to Detect This Technique

Early detection of PubPrn abuse is critical due to several potential impacts on systems and networks:

• Defense Evasion: Attackers leverage pubprn.vbs to bypass security controls, allowing them to operate undetected within victim environments.

• Privilege Escalation: Malicious execution of scripts via pubprn.vbs may enable attackers to escalate privileges, gaining administrative access and control.

• Persistence: Attackers may use pubprn.vbs to establish persistent footholds, complicating remediation efforts.

• Data Exfiltration and System Compromise: Malicious scripts executed through pubprn.vbs may lead to unauthorized access, data theft, and further compromise of critical systems.

• Operational Impact: Undetected abuse of trusted scripts can result in prolonged attacker presence, increasing the likelihood of significant operational disruptions and financial losses.

Detecting this technique early allows organizations to:

• Prevent unauthorized execution of malicious scripts.

• Minimize the window of attacker operations and mitigate potential damage.

• Strengthen overall security posture by identifying gaps in application control and endpoint monitoring solutions.

Examples

Real-world examples demonstrating the use of PubPrn (T1216.001) include:

• APT32 (OceanLotus):

  • Utilized pubprn.vbs to execute malicious scripts and bypass application whitelisting controls.

  • Leveraged this technique to evade endpoint detection solutions and establish persistent access within targeted organizations.

• FIN7:

  • Observed abusing pubprn.vbs scripts in targeted attacks against financial institutions.

  • Utilized this sub-technique to execute payloads stealthily, evade detection, and maintain persistence.

• Red Team Operations:

  • Security researchers and penetration testers frequently leverage pubprn.vbs to demonstrate bypassing of application control measures.

  • Commonly used in red team assessments to illustrate gaps in endpoint security and monitoring practices.

Typical tools and methods observed in these scenarios include:

• Execution of PowerShell payloads via pubprn.vbs invocation.

• Using pubprn.vbs to download and execute malicious binaries from remote servers.

• Employing pubprn.vbs scripts to execute encoded commands or obfuscated scripts for evasion purposes.

Impacts observed in real-world scenarios:

• Successful evasion of antivirus and EDR solutions, allowing attackers prolonged access.

• Unauthorized privilege escalation and lateral movement within compromised networks.

• Data exfiltration, intellectual property theft, and operational disruption resulting from prolonged attacker presence.