SyncAppvPublishingServer Execution to Bypass Powershell Restriction

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•1

Detects SyncAppvPublishingServer process execution which usually utilized by adversaries to bypass PowerShell execution restrictions.