Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1216.001sub-technique of T1216 System Script Proxy Execution

PubPrn

Windowsnothing on this site yetT1216.001 on attack.mitre.org

Adversaries may use PubPrn to proxy execution of malicious remote files. PubPrn.vbs is a Visual Basic script that publishes a printer to Active Directory Domain Services. The script may be signed by Microsoft and is commonly executed through the Windows Command Shell via `Cscript.exe`. For example, the following code publishes a printer within the specified domain: `cscript pubprn Printer1 LDAP://CN=Container1,DC=Domain1,DC=Com`.

MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Detecting Remote Script Proxy Execution via PubPrn.vbs

  • Execution of PubPrn.vbs via cscript.exe using the 'script:' moniker to load and execute a remote.sct scriptlet file, bypassing signature validation and proxying remote payloads through a signed Microsoft script host.

what reduces it

  • M1038 Execution Prevention. Certain signed scripts that can be used to execute other programs may not be necessary within a given environment. Use application control configured to block execution of these scripts if they are not required for a given system or network to prevent potential misuse by adversaries.
  • M1040 Behavior Prevention on Endpoint. On Windows 10, update Windows Defender Application Control policies to include rules that block the older, vulnerable versions of PubPrn.

the rest of T1216

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.