Pubprn.vbs signed script proxy execution

BIOC High

Pubprn.vbs signed script proxy execution

Pubprn.vbs is a standard script that is installed with Windows that can be abused to run malicious scripts. This behavior may bypass signature validation restrictions and application whitelisting solutions.

Module:: Platform Analytics
Agent event type:: Process execution
Category:: Execution
Status:: Enabled

ATT&CK tactics: Defense Evasion (TA0005)

ATT&CK techniques: System Script Proxy Execution: PubPrn (T1216.001)

Indicator:

Process action type = execution AND target process cmd = *pubprn.vbs*script:*

Preventable: yes