Windows PowerShell Script Block Logging: SyncAppvPublishingServer.exe Execution

Flags PowerShell script blocks that reference SyncAppvPublishingServer.exe, indicating possible execution via a PowerShell-restricted workflow.

FreeUnreviewedSigmamediumv1

windows-powershell-script-block-logging-syncappvpublishingserver-exe-execution-dddfebae

title: "Windows PowerShell Script Block Logging: SyncAppvPublishingServer.exe Execution"
id: 7bcf488d-57c8-4848-8a30-3592c92e7af0
related:
  - id: fde7929d-8beb-4a4c-b922-be9974671667
    type: derived
  - id: 9f7aa113-9da6-4a8d-907c-5f1a4b908299
    type: derived
  - id: dddfebae-c46f-439c-af7a-fdb6bde90218
    type: derived
status: test
description: This rule matches PowerShell script block content containing the string SyncAppvPublishingServer.exe. Attackers can use this binary invocation to reduce reliance on blocked PowerShell execution paths. It relies on Script Block Logging telemetry that records the script content being executed in PowerShell.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Syncappvpublishingserver/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_syncappvpublishingserver_exe.yml
author: Ensar Şamil, @sblmsrsn, OSCD Community, Huntrule Team
date: 2020-10-05
modified: 2022-12-25
tags:
  - attack.stealth
  - attack.t1218
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains: SyncAppvPublishingServer.exe
  condition: selection
falsepositives:
  - App-V clients
level: medium
license: DRL-1.1

What it detects

This rule matches PowerShell script block content containing the string SyncAppvPublishingServer.exe. Attackers can use this binary invocation to reduce reliance on blocked PowerShell execution paths. It relies on Script Block Logging telemetry that records the script content being executed in PowerShell.

Known false positives

App-V clients

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.