T1216.002 SyncAppvPublishingServer

Adversaries may abuse SyncAppvPublishingServer.vbs to proxy execution of malicious PowerShell commands. SyncAppvPublishingServer.vbs is a Visual Basic script associated with how Windows virtualizes applications (Microsoft Application Virtualization, or App-V).⁶ For example, Windows may render Win32 applications to users as virtual applications, allowing users to launch and interact with them as if they were installed locally.²⁵

The SyncAppvPublishingServer.vbs script is legitimate, may be signed by Microsoft, and is commonly executed from \System32 through the command line via wscript.exe.¹³

Adversaries may abuse SyncAppvPublishingServer.vbs to bypass PowerShell execution restrictions and evade defensive counter measures by “living off the land.”⁷¹ Proxying execution may function as a trusted/signed alternative to directly invoking powershell.exe.⁴

For example, PowerShell commands may be invoked using:³

SyncAppvPublishingServer.vbs "n; {PowerShell}"

Mitigations

References