SyncAppvPublishingServer.vbs Command Injection For Proxy Execution

Tim Peck@timpeck

•updated Jan 23, 2026•3•1•56

Detects the use of a command injection vulnerability in the legitimate Windows script 'SyncAppvPublishingServer.vbs' to execute arbitrary code. As seen in the ClearFake campaign, attackers can append a semicolon to the command-line arguments to execute subsequent malicious PowerShell commands.