SyncAppvPublishingServer Execute Arbitrary PowerShell Code

 1title: SyncAppvPublishingServer Execute Arbitrary PowerShell Code
 2id: fbd7c32d-db2a-4418-b92c-566eb8911133
 3related:
 4    - id: fde7929d-8beb-4a4c-b922-be9974671667
 5      type: obsolete
 6status: test
 7description: Executes arbitrary PowerShell code using SyncAppvPublishingServer.exe.
 8references:
 9    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md
10    - https://lolbas-project.github.io/lolbas/Binaries/Syncappvpublishingserver/
11author: frack113
12date: 2021-07-12
13modified: 2022-10-04
14tags:
15    - attack.defense-evasion
16    - attack.t1218
17logsource:
18    category: process_creation
19    product: windows
20detection:
21    selection_img:
22        - Image|endswith: '\SyncAppvPublishingServer.exe'
23        - OriginalFileName: 'syncappvpublishingserver.exe'
24    selection_cli:
25        CommandLine|contains: '"n; '
26    condition: all of selection_*
27fields:
28    - ComputerName
29    - User
30    - CommandLine
31    - ParentCommandLine
32falsepositives:
33    - App-V clients
34level: medium

References

• atomic-red-team/atomics/T1218/T1218.md at f339e7da7d05f6057fdfcdd3742bfcf365fee2a9 · redcanaryco/atomic-red-team

  

  Small and highly portable detection tests based on MITRE's ATT&CK. - redcanaryco/atomic-red-team

  
  Read More

• Syncappvpublishingserver on LOLBAS

  

  SyncAppvPublishingServer.exe is a living-of-the-land file containing unexpected functionality that can be abused by attackers; this page lists all its use cases.

  
  Read More

Related rules

• Abusing Print Executable
• AddinUtil.EXE Execution From Uncommon Directory
• AgentExecutor PowerShell Execution
• Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE
• Arbitrary File Download Via MSOHTMED.EXE