huntrule

Windows Process Execution Proxy Using SyncInvoke in CL_Invocation.ps1

Alerts on Windows command lines containing "SyncInvoke" consistent with CL_Invocation.ps1 execution proxy behavior.

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
Nasreddine Bencherchali (Nextron Systems), oscd.community, Natalia Shornikova (SigmaHQ), DRL 1.1
Published
2020-10-14
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process executions where the command line contains the function call "SyncInvoke" associated with CL_Invocation.ps1 behavior that proxies execution via System.Diagnostics.Process. Attackers may use this pattern to run code through an execution proxy while blending into normal PowerShell-driven command lines. The detection relies on Windows process creation telemetry and matches command-line text containing "SyncInvoke ".

Reporting behind it

Related detections9 linkedT1216 — drag to rearrange
Suspicious PowerShell Execution via SyncAppvPublishingServer LOLBIN
PowerShell Proxy Execution via SyncAppvPublishingServer (via process_creation)
Malicious Command Injection via SyncAppvPublishingServer VBS LOLBin (via process_creation)
Suspicious winrm.vbs LOLBAS Script Execution for Code Proxying
Windows: Code execution via Pester.bat invoked by PowerShell (Invoke-Pester/Get-Help)
Windows: Uncommon Child Processes Spawned by sigverif.exe
Windows: Suspicious CustomShellHost.exe execution spawned by non-Explorer parent
PowerShell: Signed UtilityFunctions.ps1 Loading Managed DLL via Proxy Execution
Windows PowerShell Script Proxy Execution via CL_mutexverifiers.ps1
Windows Process Execution Proxy Using SyncInvoke in CL_Invocation.ps1
Pivot detection · T1216 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.