Windows: Pubprn.vbs Signed Script Proxy Execution via script: Command Line

Flags command-line executions referencing Pubprn.vbs with 'script:' indicative of proxy script command execution on Windows.

FreeUnreviewedSigmamediumv1

windows-pubprn-vbs-signed-script-proxy-execution-via-script-command-line-1fb76ab8

title: "Windows: Pubprn.vbs Signed Script Proxy Execution via script: Command Line"
id: d4e1ea1a-217f-49db-9450-fd266aa835b1
status: test
description: This rule identifies process executions where the command line includes both a reference to '\pubprn.vbs' and the 'script:' scheme, indicating use of the signed script as a command execution proxy. Attackers may use this signed component to blend in with legitimate Windows activity while invoking arbitrary script-driven behavior. The detection relies on Windows process creation telemetry and matches specific command-line substrings.
references:
  - https://lolbas-project.github.io/lolbas/Scripts/Pubprn/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_pubprn.yml
author: frack113, Huntrule Team
date: 2022-05-28
tags:
  - attack.stealth
  - attack.t1216.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - \pubprn.vbs
      - "script:"
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 1fb76ab8-fa60-4b01-bddd-71e89bf555da
    type: derived

What it detects

This rule identifies process executions where the command line includes both a reference to '\pubprn.vbs' and the 'script:' scheme, indicating use of the signed script as a command execution proxy. Attackers may use this signed component to blend in with legitimate Windows activity while invoking arbitrary script-driven behavior. The detection relies on Windows process creation telemetry and matches specific command-line substrings.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.