SyncAppvPublishingServer VBS Executes Arbitrary PowerShell Code

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•15

This rule detects the execution of `SyncAppvPublishingServer.vbs` with a command-line argument containing a semicolon, which is indicative of arbitrary PowerShell code execution. Adversaries can abuse this legitimate VBScript to bypass PowerShell execution restrictions and evade defensive measures by proxying execution through a trusted, signed binary.