T1216.001 — PubPrn

Tactic: Stealth · Platforms: Windows

Adversaries may use PubPrn to proxy execution of malicious remote files. PubPrn.vbs is a Visual Basic script that publishes a printer to Active Directory Domain Services. The script may be signed by Microsoft and is commonly executed through the Windows Command Shell via Cscript.exe. For example,…

Sub-technique of System Script Proxy Execution (T1216).

Sigma detection rules (1)

T1216.001 System Script Proxy Execution: PubPrn

title: "T1216.001 System Script Proxy Execution: PubPrn"
id: f6658842-1c7a-468b-927d-7184ea942279
description: 'Detecting Remote Script Proxy Execution via PubPrn.vbs. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: CommandLineRegex, ParentProcessName, NetworkDestinationDomain, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1216/001
author: Shahrukh Khan
date: 2026-05-20
license: MIT
tags:
  - attack.stealth
  - attack.t1216.001

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    Image|endswith: '\PubPrn.vbs'

  condition: selection

falsepositives:
  - Legitimate printer-publishing scripts almost never invoke PubPrn.vbs with an external URL — the presence of this script executing at all is a strong indicator regardless of arguments.

level: high

Related sub-techniques

Explore