SyncAppvPublishingServer.vbs Execution via WScript/CScript

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects the execution of SyncAppvPublishingServer.vbs via wscript.exe or cscript.exe. This legitimate Windows script can be abused by adversaries to proxy execution of malicious PowerShell commands, bypassing execution restrictions and evading defensive measures.