SyncAppvPublishingServer Executes Arbitrary PowerShell Code

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•21

This rule detects the execution of arbitrary PowerShell code using SyncAppvPublishingServer.exe. Adversaries may abuse this legitimate Windows binary to proxy execution of malicious PowerShell commands, often as a method of defense evasion and to bypass PowerShell execution restrictions. The detection specifically looks for the execution of 'SyncAppvPublishingServer.exe' or 'syncappvpublishingserver.exe' with a command line containing '"n; ' which is a known pattern for invoking PowerShell via this binary.