Script proxy runs PowerShell through SyncAppvPublishingServer

Siemphony@siemphonyhighT1216.002unverified

AN1220 describes SyncAppvPublishingServer.vbs being driven through a script interpreter with PowerShell embedded in the command line, so that a Microsoft-signed VBScript carries the payload instead of a direct powershell.exe invocation. The rule reproduces that shape on Sysmon EventID 1 in three parts: the interpreter, the script name, and a payload indicator in the same command line. The payload list is authored, not MITRE's — MITRE names the `CommandLineRegex` knob and gives `{powershell -nop -enc ...}` as its one example, and the list here is populated with the semicolon the script uses to split its argument plus the PowerShell verbs and encoders an operator reaches for after it. The interpreter list follows MITRE's `ScriptInterpreter` knob, which names wscript.exe, cscript.exe and cmd.exe; powershell.exe is deliberately not in it, because an administrator hashing or enumerating the script from a PowerShell line would then satisfy every leg on its own. Two gaps are worth stating rather than hiding: a renamed copy of the script defeats the name match, and the separate compiled SyncAppvPublishingServer.exe is out of scope for this technique and this rule. The other three sources in AN1220 are not used — PowerShell 4103/4104 sees the payload only after it has already been handed off, with nothing tying it back to the proxy, and Sysmon EventID 7 and EventID 10 carry no command line at all, so the abuse is simply not expressible there. Prerequisite: Sysmon is not present in a default install; where this category is fed by Security 4688 instead, both *Audit Process Creation* and the separate *Include command line in process creation events* policy must be on, and the field names differ — an empty result means blind, not quiet. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0440, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (((FolderPath endswith "\\wscript.exe" or FolderPath endswith "\\cscript.exe" or FolderPath endswith "\\cmd.exe") and ProcessCommandLine contains "SyncAppvPublishingServer.vbs") and (ProcessCommandLine contains ";" or ProcessCommandLine contains "powershell" or ProcessCommandLine contains "pwsh" or ProcessCommandLine contains "-enc" or ProcessCommandLine contains "IEX" or ProcessCommandLine contains "Invoke-Expression" or ProcessCommandLine contains "Net.WebClient" or ProcessCommandLine contains "DownloadString" or ProcessCommandLine contains "DownloadFile" or ProcessCommandLine contains "FromBase64String"))

Splunk · SPL

Run this as a search.

index=* (((Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\cmd.exe") AND CommandLine="*SyncAppvPublishingServer.vbs*") AND (CommandLine="*;*" OR CommandLine="*powershell*" OR CommandLine="*pwsh*" OR CommandLine="*-enc*" OR CommandLine="*IEX*" OR CommandLine="*Invoke-Expression*" OR CommandLine="*Net.WebClient*" OR CommandLine="*DownloadString*" OR CommandLine="*DownloadFile*" OR CommandLine="*FromBase64String*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(process.executable) LIKE "*\\\\wscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cmd.exe") AND TO_LOWER(process.command_line) LIKE "*syncappvpublishingserver.vbs*") AND (TO_LOWER(process.command_line) LIKE "*;*" OR TO_LOWER(process.command_line) LIKE "*powershell*" OR TO_LOWER(process.command_line) LIKE "*pwsh*" OR TO_LOWER(process.command_line) LIKE "*-enc*" OR TO_LOWER(process.command_line) LIKE "*iex*" OR TO_LOWER(process.command_line) LIKE "*invoke-expression*" OR TO_LOWER(process.command_line) LIKE "*net.webclient*" OR TO_LOWER(process.command_line) LIKE "*downloadstring*" OR TO_LOWER(process.command_line) LIKE "*downloadfile*" OR TO_LOWER(process.command_line) LIKE "*frombase64string*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\wscript\.exe$|\\cscript\.exe$|\\cmd\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)SyncAppvPublishingServer\.vbs</field>    <field name="CommandLine" type="pcre2">(?i)(;|powershell|pwsh|-enc|IEX|Invoke-Expression|Net\.WebClient|DownloadString|DownloadFile|FromBase64String)</field>    <description>Script proxy runs PowerShell through SyncAppvPublishingServer</description>    <mitre>      <id>T1216.002</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: high
Category: signed_binary_proxy
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: d418c33d-b5bc-4b3c-a18f-29044d977dd7

ATT&CKT1216.002

T1216.002SyncAppvPublishingServer

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonsigned binary proxy

signed binary proxyAI draft — unreviewed

01 · What this rule detects

AN1220 describes one shape: SyncAppvPublishingServer.vbs driven through a script interpreter with PowerShell embedded in the same command line, so a Microsoft-signed VBScript carries the payload instead of powershell.exe. The script splits its argument on a semicolon and hands everything after it to PowerShell, so the injection hides inside what should be a publishing-server name. The rule reads Sysmon EventID 1 and asks three things of one event: who ran, what they ran, and what rode along.

02 · Telemetry you need

category: process_creation / product: windows, copied verbatim from AN1220 — Sysmon EventID 1. Sysmon is not in a default install. Where the category is fed by Security 4688 instead, Audit Process Creation is not enough: the separate Include command line in process creation events policy is what populates CommandLine, and without it two of the three selections have nothing to read. Zero rows then means blind, not quiet.
AN1220's other three sources are unused, and the reason is worth knowing. PowerShell 4103/4104 sees the payload only after the hand-off, with nothing tying it back to the proxy. Sysmon EventID 7 and EventID 10 carry no command line at all, so the abuse is simply not expressible there.

03 · How the logic works

selection_interpreter is Image|endswith over \wscript.exe, \cscript.exe and \cmd.exe — MITRE's ScriptInterpreter knob names exactly those three. powershell.exe is deliberately absent: an administrator hashing the script from a PowerShell prompt would otherwise satisfy every leg on its own. selection_script is CommandLine|contains: 'SyncAppvPublishingServer.vbs'. selection_payload is a ten-term contains list, and it is authored, not MITRE's — MITRE names the CommandLineRegex knob and offers {powershell -nop -enc ...} as its single example; the semicolon, pwsh, IEX, DownloadString, FromBase64String and the rest were chosen here. All three blocks are ANDed. Note what that list actually contributes. For the canonical invocation the ; term subsumes every other term — the payload cannot reach PowerShell without it. The remaining nine only add matches for command lines that name the script and a PowerShell verb with no injection at all, which is documentation and inventory tooling. Gating on ; alone would give the same true-positive coverage.

04 · Common false positives

Less than the rule claims, and its first false positive is wrong about why. That entry asserts an App-V operator chains commands on one cmd.exe line and trips the semicolon by itself. cmd.exe does not chain on ; — it uses &, && and |, and treats ; as a token delimiter. A PowerShell prompt does split on ;, but the text after it lands in a different process's command line. The only way ; reaches this command line is inside the argument handed to the script, which is the injection.
What will genuinely match: App-V automation passing a semicolon-delimited publishing-server list, LOLBAS hardening and software-inventory jobs that name the script while checking whether it is present or blocked, and purple-team frameworks replaying the published test case verbatim.

05 · Detection maturity

tier_1: , and it stays there. The rule was derived from a MITRE scaffold that ships no query logic and has never been run against a single log line; the reasoning above is analysis, not evidence.
tier_2: is two weeks read-only: count how often `SyncAppvPublishingServer.vbs` appears at all, then how many of those carry a semicolon. That one ratio decides whether the verb list stays.
tier_3: ** correlates the proxy invocation with the PowerShell that follows inside MITRE's TimeWindow, so the alert carries the payload rather than the wrapper.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Baseline first. On most estates this script is never invoked; if that holds,
If the verb terms produce inventory noise, cut selection_payload to ;.
Close the stated gaps consciously. A renamed copy defeats the name match, and
MITRE's PowerShellObfuscationScore and TimeWindow knobs need scoring and

Declared by the author

Application Virtualization administration scripts. An App-V operator troubleshooting publishing refresh may chain the sync call with another command on one cmd.exe line, and the semicolon in the payload list is satisfied by that chaining alone.
LOLBAS hardening, software inventory and baseline-compliance jobs that walk System32 from a cmd.exe wrapper and name SyncAppvPublishingServer.vbs explicitly while checking whether it is present, blocked or removed.
Atomic Red Team, Caldera and similar purple-team frameworks replaying the published T1216.002 test case, which uses this command line verbatim, and detection-engineering lab hosts reproducing the same public proof of concept.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1216.002, evaluated against their process_creation events.

Share this rule

/u/siemphony/d418c33d-b5bc-4b3c-a18f-29044d977dd7

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Script proxy runs PowerShell through SyncAppvPublishingServer

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it