PowerShell Execution via SyncAppvPublishingServer.vbs

Kaung Khant Ko@kaungkhantko

•updated Jan 27, 2026•23•1•168

Detects PowerShell execution initiated by the signed Microsoft App-V script 'SyncAppvPublishingServer.vbs'. This technique is used as a LOLBIN to proxy malicious PowerShell commands, as seen in campaigns delivering Amatera Stealer.