All Detections

Code Execution via SyncAppvPublishingServer

avatar
Daniel Koifman@Koifsec
updated Feb 26, 2026027

The rule detects the execution of a command line containing both SyncAppvPublishingServer.vbs and a semicolon (;).

Splunk (SPL)