Pubprn.vbs Proxy Execution via LOLBAS

'Pubprn.vbs' is a built-in, digitally signed Windows script located in the System32 directory, intended for printer administration. Threat actors abuse this living-off-the-land binary (LOLBAS) to bypass application control policies and execution restrictions. By invoking the script with specific arguments, an attacker can point the script to a remote or local malicious .sct (Script Component) file, causing 'Pubprn.vbs' to load and execute the code within that file. Because 'Pubprn.vbs' is a trusted, signed Microsoft component, its usage to launch malicious payloads can often bypass signature-based detection mechanisms that rely on process reputation. Defenders must monitor for command-line arguments that utilize 'Pubprn.vbs' to load external scripts, as this is a known technique for proxying execution and maintaining stealth during the post-exploitation phase.

Impact

Successful exploitation allows attackers to execute arbitrary code with the privileges of the user running the script. This facilitates defense evasion, persistence, and potential escalation if the script is invoked by a process with elevated permissions. This technique is observed in various campaigns involving fileless malware, credential harvesting, and staged payload delivery.

Recommendation

• Deploy the provided Sigma rule to detect the specific command-line usage of 'Pubprn.vbs' for proxy execution.
• Establish a baseline for legitimate printer management activities in your environment to minimize false positives related to administrative scripts.
• Utilize EDR telemetry to audit all child processes spawned by 'cscript.exe' or 'wscript.exe' when 'Pubprn.vbs' is present in the parent process path.