huntrule

Windows Process Execution of SyncAppvPublishingServer.vbs with Inline PowerShell Commands

Flags Windows executions of SyncAppvPublishingServer.vbs with a semicolon-augmented command line consistent with embedded PowerShell.

FreeReviewedSigma · Medium · v2
Product
windows
Category
process_creation
Author
frack113 (SigmaHQ), DRL 1.1
Published
2021-07-16
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows executions of SyncAppvPublishingServer.vbs where the command line includes the script path along with a semicolon, indicating potential inline command chaining. Attackers can use this technique to run arbitrary PowerShell commands via a trusted or commonly available script mechanism. The detection relies on process creation telemetry and specifically matches command-line content.

Reporting behind it

Related detections9 linkedT1218 — drag to rearrange
Suspicious PowerShell Execution via SyncAppvPublishingServer LOLBIN
Suspicious Cabinet Extraction of Masqueraded vstm Archive via extrac32
PowerShell Proxy Execution via SyncAppvPublishingServer (via process_creation)
Malicious DLL Execution via Wuauclt Update Handler (via process_creation)
Malicious Command Injection via SyncAppvPublishingServer VBS LOLBin (via process_creation)
Malicious aspnet_compiler.exe Injection Host Spawned by PowerShell via process_creation
Malicious regsvcs LOLBin Loading Ransomware DLL from UNC Path
Suspicious winrm.vbs LOLBAS Script Execution for Code Proxying
Suspicious RegAsm or RegSvcs Spawned by Script Host (via process_creation)
Windows Process Execution of SyncAppvPublishingServer.vbs with Inline PowerShell Commands
Pivot detection · T1218 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.