SyncAppvPublishingServer Script Proxy Execution
This rule detects HTTP requests where the URI contains "SyncAppvPublishingServer" case-insensitively. This pattern is often associated with script proxy execution, a technique used by attackers to execute malicious scripts by leveraging legitimate system utilities. The rule specifically looks for this string in the URI of established, to-server HTTP flows, indicating potential trojan activity or defense evasion.
Suricata
