SyncAppvPublishingServer.vbs belongs to Microsoft Application Virtualization (App-V), the feature that lets Windows present virtualized applications as if they were installed locally. The script is legitimate, may be signed by Microsoft, and is commonly run from System32 through wscript.exe. MITRE ATT&CK tracks its abuse as T1216.002 in the Stealth tactic, on Windows.
How attackers use it
MITRE says adversaries may abuse the script to proxy PowerShell commands. That lets them get around PowerShell execution restrictions and defensive countermeasures by living off the land. Running PowerShell through a trusted, signed script is an alternative to invoking powershell.exe directly, so rules that only watch the direct launch can miss it.
How to detect it
The detection strategy on the MITRE page looks for SyncAppvPublishingServer.vbs executed through wscript.exe with a command line containing embedded PowerShell. You need process creation events with command lines. Also watch for PowerShell started as a child of the script host.
If you do not use App-V, any appearance of this script in process telemetry deserves a look.
How to reduce the risk
MITRE lists one mitigation, execution prevention. Certain signed scripts that can execute other programs may not be needed in your environment. Where that is true, configure application control to block them.
Quick check
Why can this technique evade a rule that watches powershell.exe?
The PowerShell commands are launched through a signed VBScript that runs under wscript.exe, so the first process in the chain is not powershell.exe.
Sources
- MITRE ATT&CK, T1216.002: https://attack.mitre.org/techniques/T1216/002
