adpare
82 lines
5.2 KiB
JSON
82 lines
5.2 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--14f59afb-5b55-4c4b-adbf-d1f9070fcbe6",
|
|
"spec_version": "2.0",
|
|
"objects": [
|
|
{
|
|
"type": "attack-pattern",
|
|
"id": "attack-pattern--e6f19759-dde3-47fc-99cc-d9f5fa4ade60",
|
|
"created": "2024-02-06T16:20:41.647Z",
|
|
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
|
|
"revoked": false,
|
|
"external_references": [
|
|
{
|
|
"source_name": "mitre-attack",
|
|
"url": "https://attack.mitre.org/techniques/T1216/002",
|
|
"external_id": "T1216.002"
|
|
},
|
|
{
|
|
"source_name": "4 - appv",
|
|
"description": "John Fokker. (2022, March 17). Suspected DarkHotel APT activity update. Retrieved February 6, 2024.",
|
|
"url": "https://www.trellix.com/en-ca/about/newsroom/stories/research/suspected-darkhotel-apt-activity-update/"
|
|
},
|
|
{
|
|
"source_name": "2 - appv",
|
|
"description": "Microsoft. (2022, November 3). Getting started with App-V for Windows client. Retrieved February 6, 2024.",
|
|
"url": "https://learn.microsoft.com/en-us/windows/application-management/app-v/appv-getting-started"
|
|
},
|
|
{
|
|
"source_name": "5 - appv",
|
|
"description": "Nick Landers, Casey Smith. (n.d.). /Syncappvpublishingserver.vbs. Retrieved February 6, 2024.",
|
|
"url": "https://lolbas-project.github.io/lolbas/Scripts/Syncappvpublishingserver/"
|
|
},
|
|
{
|
|
"source_name": "7 - appv",
|
|
"description": "Nick Landers. (2017, August 8). Need a signed alternative to Powershell.exe? SyncAppvPublishingServer in Win10 has got you covered.. Retrieved September 12, 2024.",
|
|
"url": "https://x.com/monoxgas/status/895045566090010624"
|
|
},
|
|
{
|
|
"source_name": "3 - appv",
|
|
"description": "Raj Chandel. (2022, March 17). Indirect Command Execution: Defense Evasion (T1202). Retrieved February 6, 2024.",
|
|
"url": "https://www.hackingarticles.in/indirect-command-execution-defense-evasion-t1202/"
|
|
},
|
|
{
|
|
"source_name": "1 - appv",
|
|
"description": "SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.",
|
|
"url": "https://securelist.com/bluenoroff-methods-bypass-motw/108383/"
|
|
},
|
|
{
|
|
"source_name": "6 - appv",
|
|
"description": "Strontic. (n.d.). SyncAppvPublishingServer.exe. Retrieved February 6, 2024.",
|
|
"url": "https://strontic.github.io/xcyclopedia/library/SyncAppvPublishingServer.exe-3C291419F60CDF9C2E4E19AD89944FA3.html"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
|
|
],
|
|
"modified": "2026-04-15T22:42:56.654Z",
|
|
"name": "SyncAppvPublishingServer",
|
|
"description": "Adversaries may abuse SyncAppvPublishingServer.vbs to proxy execution of malicious [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands. SyncAppvPublishingServer.vbs is a Visual Basic script associated with how Windows virtualizes applications (Microsoft Application Virtualization, or App-V).(Citation: 1 - appv) For example, Windows may render Win32 applications to users as virtual applications, allowing users to launch and interact with them as if they were installed locally.(Citation: 2 - appv)(Citation: 3 - appv)\n \nThe SyncAppvPublishingServer.vbs script is legitimate, may be signed by Microsoft, and is commonly executed from `\\System32` through the command line via `wscript.exe`.(Citation: 4 - appv)(Citation: 5 - appv)\n\nAdversaries may abuse SyncAppvPublishingServer.vbs to bypass [PowerShell](https://attack.mitre.org/techniques/T1059/001) execution restrictions and evade defensive counter measures by \"living off the land.\"(Citation: 6 - appv)(Citation: 4 - appv) Proxying execution may function as a trusted/signed alternative to directly invoking `powershell.exe`.(Citation: 7 - appv)\n\nFor example, [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands may be invoked using:(Citation: 5 - appv)\n\n`SyncAppvPublishingServer.vbs \"n; {PowerShell}\"`",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "stealth"
|
|
}
|
|
],
|
|
"x_mitre_attack_spec_version": "3.3.0",
|
|
"x_mitre_contributors": [
|
|
"Shaul Vilkomir-Preisman"
|
|
],
|
|
"x_mitre_deprecated": false,
|
|
"x_mitre_domains": [
|
|
"enterprise-attack"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
|
|
"x_mitre_platforms": [
|
|
"Windows"
|
|
],
|
|
"x_mitre_version": "2.0"
|
|
}
|
|
]
|
|
} |