App-V Publishing Script LOLBIN Execution
Detects the execution of the signed Microsoft App-V script 'SyncAppvPublishingServer.vbs' by a script host like wscript.exe or cscript.exe. This technique is used as a LOLBIN to proxy execution of other code, such as PowerShell, bypassing detections that focus on direct PowerShell execution or common parent-child process relationships. This was observed in a campaign delivering Amatera Stealer.
Sigma
