Windows PowerShell Module: SyncAppvPublishingServer.exe Command-Line Usage

Alerts when SyncAppvPublishingServer.exe appears in PowerShell module ContextInfo on Windows.

FreeUnreviewedSigmamediumv1

windows-powershell-module-syncappvpublishingserver-exe-command-line-usage-fe5ce7eb

title: "Windows PowerShell Module: SyncAppvPublishingServer.exe Command-Line Usage"
id: 813dac71-433f-4ae6-b71d-c0a8f5da16d4
related:
  - id: fde7929d-8beb-4a4c-b922-be9974671667
    type: derived
  - id: 9f7aa113-9da6-4a8d-907c-5f1a4b908299
    type: derived
  - id: fe5ce7eb-dad8-467c-84a9-31ec23bd644a
    type: derived
status: test
description: This rule flags execution of SyncAppvPublishingServer.exe when its command context contains the executable name. Adversaries may use this Windows binary to invoke functionality that can bypass PowerShell execution restrictions. The detection relies on PowerShell module telemetry capturing ContextInfo text that includes SyncAppvPublishingServer.exe.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Syncappvpublishingserver/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_module/posh_pm_syncappvpublishingserver_exe.yml
author: Ensar Şamil, @sblmsrsn, OSCD Community, Huntrule Team
date: 2020-10-05
modified: 2022-12-02
tags:
  - attack.stealth
  - attack.t1218
logsource:
  product: windows
  category: ps_module
  definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
  selection:
    ContextInfo|contains: SyncAppvPublishingServer.exe
  condition: selection
falsepositives:
  - App-V clients
level: medium
license: DRL-1.1

What it detects

This rule flags execution of SyncAppvPublishingServer.exe when its command context contains the executable name. Adversaries may use this Windows binary to invoke functionality that can bypass PowerShell execution restrictions. The detection relies on PowerShell module telemetry capturing ContextInfo text that includes SyncAppvPublishingServer.exe.

Known false positives

App-V clients

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.