Techniques › T1216.001 › AN1464
AN1464 Analytic 1464
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Execution of PubPrn.vbs via cscript.exe using the 'script:' moniker to load and execute a remote .sct scriptlet file, bypassing signature validation and proxying remote payloads through a signed Microsoft script host.</p>
- Detects
- T1216.001 PubPrn
- Part of
- DET0528 Detecting Remote Script Proxy Execution via PubPrn.vbs
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| WinEventLog:PowerShell | EventCode=4103, 4104, 4105, 4106 | DC0064 Command Execution |
| WinEventLog:Sysmon | EventCode=3, 22 | DC0082 Network Connection Creation |
| WinEventLog:Sysmon | EventCode=7 | DC0016 Module Load |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
CommandLineRegex | Detects 'script:' moniker with HTTP/HTTPS URI as argument to pubprn.vbs |
ParentProcessName | May vary between cscript.exe, wscript.exe, or cmd.exe depending on execution method |
NetworkDestinationDomain | Used to detect external domains being contacted for remote scriptlet execution |
TimeWindow | Maximum allowed time delta between pubprn.vbs invocation and network connection or child process |