+1
@@ -6,6 +6,7 @@ related:
|
||||
- id: 9f7aa113-9da6-4a8d-907c-5f1a4b908299
|
||||
type: derived
|
||||
description: Detects SyncAppvPublishingServer process execution which usually utilized by adversaries to bypass PowerShell execution restrictions.
|
||||
status: experimental
|
||||
references:
|
||||
- https://lolbas-project.github.io/lolbas/Binaries/Syncappvpublishingserver/
|
||||
author: 'Ensar Şamil, @sblmsrsn, OSCD Community'
|
||||
|
||||
Reference in New Issue
Block a user