Which SIEM platforms have a T1216 detection rule?

df00tech provides T1216 (System Script Proxy Execution) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect System Script Proxy Execution (T1216)?

Detecting System Script Proxy Execution requires the following data sources: Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint.

What severity and confidence is the T1216 detection?

The T1216 detection is rated high severity with high confidence.

What are common false positives for T1216?

Common false positives for T1216 include: Legitimate printer publishing operations using PubPrn.vbs in enterprise printing environments — typically invoked by print administrators against a known print server, not a remote HTTP/HTTPS URL; App-V publishing infrastructure running SyncAppvPublishingServer.vbs/exe as part of scheduled application virtualization refresh — verify the server and account are expected in your App-V deployment; Security testing tools or red team exercises explicitly using LOLBAS scripts in an authorized penetration test — correlate with change management tickets.

T1216 Sumo Logic CSE · Sumo

Detect System Script Proxy Execution in Sumo Logic CSE

Adversaries may use trusted scripts, often signed with Microsoft certificates, to proxy the execution of malicious files. Several Microsoft-signed scripts that ship with Windows or are downloadable from Microsoft can be abused to proxy execution of attacker-controlled content. Primary sub-techniques include PubPrn.vbs (a printer publishing script that accepts a 'script:' COM scriptlet URL as its second argument) and SyncAppvPublishingServer.vbs/exe (an App-V publishing script that passes arguments directly to a PowerShell pipeline). Because these scripts are signed by Microsoft, they may bypass application control policies (AppLocker, WDAC) that trust Microsoft-signed content, and they evade script-based detection that focuses on unsigned or unknown interpreters. The technique falls under Defense Evasion, making it a common component of initial access payloads and post-exploitation tooling.

MITRE ATT&CK

Tactic: Defense Evasion
Technique: T1216 System Script Proxy Execution
Canonical reference: https://attack.mitre.org/techniques/T1216/

Sumo Detection Query

Sumo Logic CSE (Sumo)

sql

(_sourceCategory=*windows* OR _sourceCategory=*sysmon*)
| where EventCode = "1"
| where (
    (
      (toLowerCase(Image) endswith "\\cscript.exe" OR toLowerCase(Image) endswith "\\wscript.exe")
      AND (
        toLowerCase(CommandLine) contains "pubprn.vbs"
        OR toLowerCase(CommandLine) contains "syncappvpublishingserver.vbs"
        OR toLowerCase(CommandLine) contains "script:"
        OR toLowerCase(CommandLine) contains "scrobj.dll"
        OR toLowerCase(CommandLine) contains "scriptlet"
      )
    )
    OR (
      toLowerCase(Image) endswith "\\syncappvpublishingserver.exe"
      AND (
        toLowerCase(CommandLine) contains "start-process"
        OR toLowerCase(CommandLine) contains "invoke-expression"
        OR toLowerCase(CommandLine) contains "net.webclient"
        OR toLowerCase(CommandLine) contains "-encodedcommand"
        OR toLowerCase(CommandLine) contains "downloadstring"
        OR toLowerCase(CommandLine) contains "downloadfile"
      )
    )
    OR (
      (toLowerCase(ParentImage) endswith "\\cscript.exe" OR toLowerCase(ParentImage) endswith "\\wscript.exe")
      AND (toLowerCase(ParentCommandLine) contains "pubprn.vbs" OR toLowerCase(ParentCommandLine) contains "syncappvpublishingserver.vbs")
      AND (
        toLowerCase(Image) endswith "\\powershell.exe"
        OR toLowerCase(Image) endswith "\\pwsh.exe"
        OR toLowerCase(Image) endswith "\\cmd.exe"
        OR toLowerCase(Image) endswith "\\mshta.exe"
        OR toLowerCase(Image) endswith "\\rundll32.exe"
        OR toLowerCase(Image) endswith "\\regsvr32.exe"
        OR toLowerCase(Image) endswith "\\certutil.exe"
        OR toLowerCase(Image) endswith "\\msiexec.exe"
        OR toLowerCase(Image) endswith "\\wmic.exe"
        OR toLowerCase(Image) endswith "\\bitsadmin.exe"
      )
    )
  )
| eval ProxyScript = if (toLowerCase(CommandLine) contains "pubprn.vbs", "PubPrn",
    if (toLowerCase(CommandLine) contains "syncappvpublishingserver.vbs", "SyncAppvPublishingServer.vbs",
    if (toLowerCase(Image) endswith "\\syncappvpublishingserver.exe", "SyncAppvPublishingServer.exe",
    if (toLowerCase(ParentImage) endswith "\\cscript.exe" OR toLowerCase(ParentImage) endswith "\\wscript.exe", "ParentProxyScript",
    "Unknown"))))
| eval ScriptletExec = if (toLowerCase(CommandLine) contains "script:" OR toLowerCase(CommandLine) contains "scrobj.dll" OR toLowerCase(CommandLine) contains "scriptlet", 1, 0)
| eval SuspicionScore = 0
| eval SuspicionScore = SuspicionScore + if (ScriptletExec = 1, 3, 0)
| eval SuspicionScore = SuspicionScore + if (toLowerCase(CommandLine) contains "http", 2, 0)
| eval SuspicionScore = SuspicionScore + if (toLowerCase(CommandLine) contains "invoke-expression" OR toLowerCase(CommandLine) contains "downloadstring" OR toLowerCase(CommandLine) contains "-encodedcommand", 2, 0)
| eval DetectionBranch = if (ScriptletExec = 1 OR (toLowerCase(Image) endswith "\\cscript.exe" OR toLowerCase(Image) endswith "\\wscript.exe"), "ProxyScript_Execution",
    if (toLowerCase(Image) endswith "\\syncappvpublishingserver.exe", "SyncAppv_PS_Proxy", "ProxyScript_ChildProcess"))
| where SuspicionScore > 0
| fields _time, Computer, User, Image, CommandLine, ParentImage, ParentCommandLine, ProxyScript, ScriptletExec, SuspicionScore, DetectionBranch
| sort by _time desc

high severity high confidence

Sumo Logic CSE query detecting T1216 System Script Proxy Execution using Sysmon Event ID 1 process creation data. Covers PubPrn.vbs and SyncAppvPublishingServer proxy abuse with a weighted SuspicionScore to reduce noise, filtering out zero-score events. Classifies detections into ProxyScript_Execution, SyncAppv_PS_Proxy, and ProxyScript_ChildProcess branches matching the KQL/SPL logic.

Data Sources

Sysmon via Windows Event CollectorSumo Logic Installed Collector with Windows Event Log sourceSumo Logic Cloud-to-Cloud Windows source

Required Tables

Windows Sysmon Event ID 1 (Process Create) logsWindows Security Event ID 4688 (Process Creation with command-line auditing)

False Positives & Tuning

Managed print environments where PubPrn.vbs is called by deployment scripts or Group Policy startup scripts without scriptlet URLs — SuspicionScore would be 0 or 1
App-V streaming deployments in enterprises using SCCM that legitimately invoke SyncAppvPublishingServer.exe without PowerShell proxy arguments
Endpoint security validation platforms (Atomic Red Team, BAS tools) running T1216 simulations with approved change tickets during business hours

Download portable Sigma rule (.yml)

Other platforms for T1216

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1PubPrn.vbs Scriptlet Execution via script: Protocol
Expected signal: Sysmon Event ID 1: Process Create with Image=cscript.exe, CommandLine containing 'pubprn.vbs' and 'script:http://127.0.0.1'. Sysmon Event ID 3: Network Connection attempt to 127.0.0.1:8080 from cscript.exe. Security Event ID 4688 if command line auditing is enabled.
Test 2SyncAppvPublishingServer.vbs PowerShell Pipeline Injection
Expected signal: Sysmon Event ID 1: cscript.exe with CommandLine containing 'SyncAppvPublishingServer.vbs' and 'Write-Output'. Child process Sysmon Event ID 1: powershell.exe spawned by cscript.exe executing the injected command. Sysmon Event ID 11: File Create for t1216-test.txt in %TEMP%.
Test 3SyncAppvPublishingServer.exe Direct Invocation with PowerShell Download Cradle
Expected signal: Sysmon Event ID 1: SyncAppvPublishingServer.exe with CommandLine containing 'Invoke-Expression' and 'Net.WebClient'. Sysmon Event ID 3: Network Connection attempt to 127.0.0.1:9090. Security Event ID 4688 with full command line.
Test 4PubPrn.vbs Used from Non-Standard Location (Bypass Detection by Path)
Expected signal: Sysmon Event ID 11: File Create for pubprn.vbs in %TEMP% (potential staging artifact). Sysmon Event ID 1: cscript.exe with CommandLine referencing %TEMP%\pubprn.vbs and the 'script:' URL. Sysmon Event ID 3: Network Connection attempt from cscript.exe.

Last updated: 2026-04-13 Research depth: deep

References (10)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1216 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect System Script Proxy Execution in Sumo Logic CSE

MITRE ATT&CK

Sumo Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1216

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Sub-techniques (2)

Related Techniques

Same Tactic: Defense Evasion

Popular Detections

MITRE ATT&CK

Sumo Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1216

Testing Methodology

Unlock Pro Content

Related Detections

Sub-techniques (2)

Related Techniques

Same Tactic: Defense Evasion

Popular Detections

Get new detections in your inbox