SyncAppvPublishingServer Execution to Bypass PowerShell Restriction
Detects the execution of SyncAppvPublishingServer.exe, which is often used by adversaries to bypass PowerShell execution restrictions. This technique is part of the LOLBAS (Living Off The Land Binaries and Scripts) project, where legitimate system binaries are abused for malicious purposes, specifically to execute PowerShell commands in a way that might evade traditional security controls.
Sigma
