kevmap

TechniquesT1216.001 › AN1464

AN1464 Analytic 1464

Windows · attack.mitre.org · ATT&CK Enterprise v19.2

<p>Execution of PubPrn.vbs via cscript.exe using the 'script:' moniker to load and execute a remote .sct scriptlet file, bypassing signature validation and proxying remote payloads through a signed Microsoft script host.</p>
Detects
T1216.001 PubPrn
Part of
DET0528 Detecting Remote Script Proxy Execution via PubPrn.vbs

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log sourceChannelData component
WinEventLog:SysmonEventCode=1DC0032 Process Creation
WinEventLog:PowerShellEventCode=4103, 4104, 4105, 4106DC0064 Command Execution
WinEventLog:SysmonEventCode=3, 22DC0082 Network Connection Creation
WinEventLog:SysmonEventCode=7DC0016 Module Load

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

FieldDescription
CommandLineRegexDetects 'script:' moniker with HTTP/HTTPS URI as argument to pubprn.vbs
ParentProcessNameMay vary between cscript.exe, wscript.exe, or cmd.exe depending on execution method
NetworkDestinationDomainUsed to detect external domains being contacted for remote scriptlet execution
TimeWindowMaximum allowed time delta between pubprn.vbs invocation and network connection or child process