PubPrn Script Used for COM Scriptlet Execution

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects HTTP requests where the URI contains both 'pubprn' and '.sct' (case-insensitive). This combination is indicative of an attempt to use the 'pubprn.vbs' script for COM scriptlet execution, a technique often employed by attackers for defense evasion.