Windows: Pubprn.vbs Script Proxy Execution via script: Command Line
Flags command-line executions referencing Pubprn.vbs with 'script:' indicative of proxy script command execution on Windows.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-05-28
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule matches Windows process creation events where the command line contains both "\pubprn.vbs" and "script:". Attackers can use the Microsoft-signed Pubprn.vbs script as a proxy to run commands, helping execution blend in with legitimate tooling. It relies on process creation telemetry with the full command line string.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-pubprn-vbs-signed-script-proxy-execution-via-script-command-line-1fb76ab8
title: "Windows: Pubprn.vbs Script Proxy Execution via script: Command Line"
id: d4e1ea1a-217f-49db-9450-fd266aa835b1
status: test
description: This rule matches Windows process creation events where the command line contains both "\pubprn.vbs" and "script:". Attackers can use the Microsoft-signed Pubprn.vbs script as a proxy to run commands, helping execution blend in with legitimate tooling. It relies on process creation telemetry with the full command line string.
references:
- https://lolbas-project.github.io/lolbas/Scripts/Pubprn/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_pubprn.yml
author: frack113, Huntrule Team
date: 2022-05-28
tags:
- attack.stealth
- attack.t1216.001
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains|all:
- \pubprn.vbs
- "script:"
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 1fb76ab8-fa60-4b01-bddd-71e89bf555da
type: derived