Script proxy runs PowerShell through SyncAppvPublishingServer

1title: Script proxy runs PowerShell through SyncAppvPublishingServer2id: d418c33d-b5bc-4b3c-a18f-29044d977dd73status: experimental4description: |5  AN1220 describes SyncAppvPublishingServer.vbs being driven through a script6  interpreter with PowerShell embedded in the command line, so that a7  Microsoft-signed VBScript carries the payload instead of a direct8  powershell.exe invocation. The rule reproduces that shape on Sysmon EventID 19  in three parts: the interpreter, the script name, and a payload indicator in10  the same command line. The payload list is authored, not MITRE's — MITRE names11  the `CommandLineRegex` knob and gives `{powershell -nop -enc ...}` as its one12  example, and the list here is populated with the semicolon the script uses to13  split its argument plus the PowerShell verbs and encoders an operator reaches14  for after it. The interpreter list follows MITRE's `ScriptInterpreter` knob,15  which names wscript.exe, cscript.exe and cmd.exe; powershell.exe is16  deliberately not in it, because an administrator hashing or enumerating the17  script from a PowerShell line would then satisfy every leg on its own. Two18  gaps are worth stating rather than hiding: a renamed copy of the script19  defeats the name match, and the separate compiled SyncAppvPublishingServer.exe20  is out of scope for this technique and this rule. The other three sources in21  AN1220 are not used — PowerShell 4103/4104 sees the payload only after it has22  already been handed off, with nothing tying it back to the proxy, and Sysmon23  EventID 7 and EventID 10 carry no command line at all, so the abuse is simply24  not expressible there. Prerequisite: Sysmon is not present in a default25  install; where this category is fed by Security 4688 instead, both *Audit26  Process Creation* and the separate *Include command line in process creation27  events* policy must be on, and the field names differ — an empty result means28  blind, not quiet.29  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0440, not hand-written and not tested by its author. Any lab result is on this rule's own page.30references:31  - https://attack.mitre.org/techniques/T1216/00232  - https://attack.mitre.org/detectionstrategies/DET044033author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)34date: 2026-08-1635tags:36  - attack.defense-evasion37  - attack.t1216.00238logsource:39  category: process_creation40  product: windows41detection:42  selection_interpreter:43    Image|endswith:44      - '\wscript.exe'45      - '\cscript.exe'46      - '\cmd.exe'47  selection_script:48    CommandLine|contains: 'SyncAppvPublishingServer.vbs'49  selection_payload:50    CommandLine|contains:51      - ';'52      - 'powershell'53      - 'pwsh'54      - '-enc'55      - 'IEX'56      - 'Invoke-Expression'57      - 'Net.WebClient'58      - 'DownloadString'59      - 'DownloadFile'60      - 'FromBase64String'61  condition: selection_interpreter and selection_script and selection_payload62falsepositives:63  - "Application Virtualization administration scripts. An App-V operator troubleshooting publishing refresh may chain the sync call with another command on one cmd.exe line, and the semicolon in the payload list is satisfied by that chaining alone."64  - "LOLBAS hardening, software inventory and baseline-compliance jobs that walk System32 from a cmd.exe wrapper and name SyncAppvPublishingServer.vbs explicitly while checking whether it is present, blocked or removed."65  - "Atomic Red Team, Caldera and similar purple-team frameworks replaying the published T1216.002 test case, which uses this command line verbatim, and detection-engineering lab hosts reproducing the same public proof of concept."66level: high