Pubprn.vbs Proxy Execution with Script Argument

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•15

Detects the use of the 'Pubprn.vbs' Microsoft signed script to execute commands, specifically looking for the 'script:' argument which can be abused for proxy execution of remote files. This technique is often used for defense evasion.