Windows ships Microsoft-signed scripts that can be persuaded to run someone else's code, and application control that trusts Microsoft's signature or the whole Windows directory will let them. MITRE ATT&CK T1216 System Script Proxy Execution covers adversaries using trusted scripts, "often signed with certificates, to proxy the execution of malicious files". In ATT&CK v20 it is a Stealth (TA0005) technique on Windows with two sub-techniques: T1216.001 PubPrn and T1216.002 SyncAppvPublishingServer. It is a narrow technique with few recorded procedures, but the scripts involved are present on most Windows estates and the fixes are cheap. This guide explains each script from the defender's side, the v20 detection strategies, the block rules and feature decisions that remove the paths, and how to test them. It is for detection engineers and endpoint owners. The wider family of trusted binaries is covered in the T1218 System Binary Proxy Execution Defensive Guide and the overall picture in the Living off the Land Guide.
Key takeaways
- The scripts are VBScript run by Windows Script Host. Both sub-techniques run
.vbsfiles throughcscript.exeorwscript.exe, so script host controls and VBScript's deprecation path apply directly. - PubPrn has been fixed, but old copies remain. ATT&CK notes Windows 10 and later limit PubPrn's second parameter to
LDAP://; Microsoft's recommended block rules still deny older PubPrn versions by hash. - SyncAppvPublishingServer is a PowerShell launcher in disguise. Its command line can carry PowerShell, so PowerShell logging and AMSI see what process names hide.
- The only listed mitigations are execution controls. v20 maps M1038 Execution Prevention to the parent and both sub-techniques, and M1040 to PubPrn.
- Detection keys on arguments and children. A
script:moniker, a URL, or an embedded PowerShell string in these scripts' arguments has almost no legitimate use.
What T1216 covers
ATT&CK describes several Microsoft-signed scripts that "have been downloaded from Microsoft or are default on Windows installations" and can be used to proxy execution of other files, bypassing application control and signature validation. v20 breaks out two of them.
| Sub-technique | Script and legitimate purpose | Abuse pattern ATT&CK describes | Current status |
|---|---|---|---|
| T1216.001 PubPrn | PubPrn.vbs, publishes a printer to Active Directory Domain Services, usually run through cscript.exe | Setting the second parameter to a script: moniker that references a remote scriptlet (.sct) file | Windows 10 and later restrict the parameter to LDAP://; older versions remain abusable |
| T1216.002 SyncAppvPublishingServer | SyncAppvPublishingServer.vbs in System32, part of Microsoft Application Virtualization (App-V), run through wscript.exe | Passing PowerShell commands in the argument string so that PowerShell runs under a signed script instead of a direct powershell.exe call | Present where the App-V client components exist |
Related techniques stay separate: T1218 for signed binaries such as regsvr32 (whose scriptlet abuse resembles PubPrn's), T1220 XSL Script Processing, and T1059 for script interpreters used directly.
How adversaries use it
v20 records one named procedure: APT32 "has used PubPrn.vbs within execution scripts to execute malware, possibly bypassing defenses". No group or software procedures are recorded for SyncAppvPublishingServer in v20; ATT&CK's description of it draws on security research showing it as a way to bypass PowerShell execution restrictions. The practical pattern for both is the same: a script host started from an execution chain (a document, an LNK file, a scheduled task) with arguments that point to remote or embedded code. See the Malicious LNK Files Guide for one common starting point.
What to detect and where
ATT&CK v20 has three detection strategies: DET0466 for the parent technique and one per sub-technique.
| Strategy and analytic | Behaviour described in v20 | Data components and log sources |
|---|---|---|
| DET0466 / AN1288 (parent) | Microsoft-signed scripts and hosts used to proxy untrusted or external binaries, seen through process lineage, child processes and unsigned payloads run from a signed parent | Process Creation (Sysmon 1), Command Execution (PowerShell 4103 to 4106), Module Load (Sysmon 7), Process Access (Sysmon 10), File Creation (Sysmon 11) |
| DET0528 / AN1464 (PubPrn) | PubPrn.vbs run via cscript.exe with the script: moniker loading a remote .sct file | Process Creation (Sysmon 1), Command Execution (PowerShell 4103 to 4106), Network Connection Creation (Sysmon 3 and 22), Module Load (Sysmon 7) |
| DET0440 / AN1220 (SyncAppvPublishingServer) | SyncAppvPublishingServer.vbs run through wscript.exe with embedded PowerShell in the command line | Process Creation (Sysmon 1), Command Execution (PowerShell 4103 to 4106), Module Load (Sysmon 7), Process Access (Sysmon 10) |
Analytics that work
- PubPrn with anything but LDAP:
cscript.exeorwscript.exewithpubprnin the command line andscript:,httpor a UNC path in the arguments. Printer publishing is an administrator task performed rarely, if ever, on user devices. - Script host making network connections: Sysmon 3 or 22 from a script host process whose command line references PubPrn, followed by scriptlet-related module loads (for example
scrobj.dll) in Sysmon 7. - SyncAppvPublishingServer with a semicolon or PowerShell syntax: a command line containing
SyncAppvPublishingServerand characters or keywords such as;,IEX,-encorDownloadString. In normal App-V use the script is called by the App-V client, not by users or Office applications. - PowerShell engine activity without powershell.exe: PowerShell 4103 and 4104 events, or PowerShell modules loaded (Sysmon 7) in a process tree whose root is
wscript.exerunning SyncAppvPublishingServer. - Unusual parents: Office applications, browsers, archive tools or
explorer.exelaunched from an LNK file starting a script host with either script name.
Tune by exception: record which hosts genuinely use App-V and which administrators publish printers, and suppress only those combinations of host, parent and account. See the Sysmon Guide and PowerShell Security Guide for the logging configuration.
Prevention and hardening
| Control | Setting or approach | Mapping |
|---|---|---|
| Microsoft recommended block rules | Merge the recommended block rules into your App Control for Business base policy, audit first. They include hash deny rules for older PubPrn builds and deny rules for cscript.exe and wscript.exe versions up to 5.812.10240.0. Hash rules match exact files, so check the rules for each Windows build. See the Application Allowlisting Guide | M1038, M1040 (ATT&CK's PubPrn mitigation) |
| Block the scripts by path or hash | Where App-V is not used, deny SyncAppvPublishingServer.vbs; deny PubPrn.vbs on devices that never publish printers | M1038, as v20 describes for both sub-techniques |
| Restrict Windows Script Host | Block wscript.exe and cscript.exe for standard users where no business script needs them; otherwise keep AMSI integration on | M1038, M1042 |
| Plan for VBScript removal | Microsoft deprecated VBScript in October 2023; in Windows 11 24H2 it is a feature on demand enabled by default, and Microsoft's blog says it will no longer be enabled by default from around 2027. See the VBScript Deprecation guide | M1042 |
| Attack surface reduction | "Block all Office applications from creating child processes" and "Block JavaScript or VBScript from launching downloaded executable content" | M1040 |
| PowerShell controls | Script block logging, Constrained Language Mode under application control, and removal of PowerShell 2.0, which Microsoft lists as deprecated | Limits what SyncAppvPublishingServer can launch |
App-V decision
Microsoft's deprecated features page states that, as of November 2024, the App-V client in Windows "is no longer deprecated and persists with a fixed extended support lifecycle", so the script will not disappear by itself. If you use App-V, keep the script but alert on any caller other than the App-V client and on embedded PowerShell. If you do not, block the script and remove the App-V components through your build process.
Rollout
- Measure: query 30 days of process telemetry for both script names, recording host, parent, account and arguments.
- Audit: deploy the block rules and any script host restrictions in audit mode and review would-be blocks with application and print owners.
- Enforce in rings: IT staff first, then standard users, leaving App-V and print servers until exceptions are documented.
- Roll back by redeploying the previous policy version; keep each exception scoped to a device group with an owner and expiry.
How to test
- Telemetry check: confirm Sysmon 1, 3, 7, 10, 11 and 22 and PowerShell 4103 and 4104 reach the SIEM from test devices.
- Benign emulation: in a lab, run SyncAppvPublishingServer with a harmless PowerShell command that writes a marker file, and run PubPrn with a non-LDAP argument on a current Windows build to confirm it is refused. Use an approved emulation framework for any remote-content test.
- Policy check: confirm the App Control policy blocks the older PubPrn hash and logs the attempt.
- Metrics: percentage of devices with the recommended block rules enforced; count of script host executions with either script name per week; percentage of those with an approved parent; time to triage an alert.
Common failure patterns
- Trusting everything Microsoft signed: both scripts carry Microsoft signatures, so publisher-only allow rules permit them.
- Assuming the PubPrn fix covers every device: older builds and copied script files can still accept the
script:moniker. - Watching only powershell.exe: SyncAppvPublishingServer runs PowerShell commands without a direct
powershell.execall from the user's chain; watch PowerShell engine events instead. - Relying on name-based deny rules for the script hosts: Microsoft's deny rules for
cscript.exeandwscript.exeonly cover versions up to 5.812.10240.0, so verify what your rules actually match. - Leaving App-V components on devices that never use them.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| MITRE ATT&CK v20 | T1216, T1216.001, T1216.002 (TA0005 Stealth); related T1218, T1059.001, T1059.005 | The technique, its sub-techniques and neighbours |
| ATT&CK detection | DET0466, DET0528, DET0440 | Official detection strategies |
| ATT&CK mitigations | M1038 Execution Prevention; M1040 Behavior Prevention on Endpoint | Official mitigations |
| NIST SP 800-53 Rev. 5 | CM-7 Least Functionality; CM-7(5) Authorized Software; SI-4 System Monitoring | Removing and blocking unneeded scripts; monitoring script hosts |
| NIST CSF 2.0 | PR.PS-05; DE.CM-09 | Preventing unauthorised software execution; monitoring endpoints |
Practitioner checklist
- Inventory use of PubPrn.vbs and SyncAppvPublishingServer.vbs across the estate.
- Merge Microsoft's recommended block rules, audit first, and verify the PubPrn hash rules for each Windows build in use.
- Block SyncAppvPublishingServer.vbs where App-V is not used; alert on non-App-V callers where it is.
- Alert on PubPrn with a
script:moniker, URL or UNC argument. - Collect PowerShell 4103 and 4104 and alert on PowerShell activity under wscript.exe.
- Restrict Windows Script Host for standard users and plan for VBScript removal.
- Enable the Office child process ASR rule.
Standards and references
- MITRE ATT&CK: System Script Proxy Execution (T1216)
- MITRE ATT&CK: PubPrn (T1216.001)
- MITRE ATT&CK: SyncAppvPublishingServer (T1216.002)
- Microsoft: Applications that can bypass App Control and how to block them
- Microsoft: Deprecated features in the Windows client
- Microsoft Windows IT Pro Blog: VBScript deprecation timelines and next steps
- Microsoft: Antimalware Scan Interface (AMSI)
- Microsoft: Attack surface reduction rules reference
Related NHI Mgmt Group resources: ATT&CK Stealth and Defense Impairment Tactics Guide · Living off the Land Guide · T1218 System Binary Proxy Execution Defensive Guide · M1038 Execution Prevention