Abuse of ScriptRunner.exe for Proxy Execution
This rule detects the execution of 'ScriptRunner.exe' with the '-appvscript' command-line argument. 'ScriptRunner.exe' is a legitimate Windows binary that can be abused to proxy execution, potentially bypassing whitelisting or other security controls. This specific command-line argument indicates its use in the context of App-V scripting, which can be leveraged for malicious purposes.
Sigma
