rules/windows/powershell/powershell_script/posh_ps_syncappvpublishingserver_exe.yml

title: SyncAppvPublishingServer Execution to Bypass Powershell Restriction
id: dddfebae-c46f-439c-af7a-fdb6bde90218
related:
    - id: fde7929d-8beb-4a4c-b922-be9974671667
      type: derived
    - id: 9f7aa113-9da6-4a8d-907c-5f1a4b908299
      type: derived
status: test
description: Detects SyncAppvPublishingServer process execution which usually utilized by adversaries to bypass PowerShell execution restrictions.
references:
    - https://lolbas-project.github.io/lolbas/Binaries/Syncappvpublishingserver/
author: 'Ensar Şamil, @sblmsrsn, OSCD Community'
date: 2020/10/05
modified: 2022/12/25
tags:
    - attack.defense_evasion
    - attack.t1218
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection:
        ScriptBlockText|contains: 'SyncAppvPublishingServer.exe'
    condition: selection
falsepositives:
    - App-V clients
level: medium
$frack113$ add ps_script verison 2021-10-18 14:13:29 +02:00			`title: SyncAppvPublishingServer Execution to Bypass Powershell Restriction`
			`id: dddfebae-c46f-439c-af7a-fdb6bde90218`
			`related:`
			`- id: fde7929d-8beb-4a4c-b922-be9974671667`
			`type: derived`
			`- id: 9f7aa113-9da6-4a8d-907c-5f1a4b908299`
			`type: derived`
$frack113$ Promotion rules (#3821 ) 2022-12-27 12:29:10 +01:00			`status: test`
$frack113$ Order yaml field 2022-10-26 09:43:39 +02:00			`description: Detects SyncAppvPublishingServer process execution which usually utilized by adversaries to bypass PowerShell execution restrictions.`
$frack113$ add ps_script verison 2021-10-18 14:13:29 +02:00			`references:`
			`- https://lolbas-project.github.io/lolbas/Binaries/Syncappvpublishingserver/`
			`author: 'Ensar Şamil, @sblmsrsn, OSCD Community'`
			`date: 2020/10/05`
$frack113$ Promotion rules (#3821 ) 2022-12-27 12:29:10 +01:00			`modified: 2022/12/25`
$frack113$ add ps_script verison 2021-10-18 14:13:29 +02:00			`tags:`
			`- attack.defense_evasion`
			`- attack.t1218`
			`logsource:`
			`product: windows`
			`category: ps_script`
feat: updates and enhancements 2023-01-04 17:49:32 +01:00			`definition: 'Requirements: Script Block Logging must be enabled'`
$frack113$ add ps_script verison 2021-10-18 14:13:29 +02:00			`detection:`
			`selection:`
$frack113$ cleanup list 2021-10-18 14:52:35 +02:00			`ScriptBlockText\|contains: 'SyncAppvPublishingServer.exe'`
$frack113$ add ps_script verison 2021-10-18 14:13:29 +02:00			`condition: selection`
			`falsepositives:`
			`- App-V clients`
$frack113$ Order yaml field 2022-10-26 09:43:39 +02:00			`level: medium`