tfMITRE ATT&CK sub-technique

SyncAppvPublishingServer T1216.002

sub-technique of T1216 System Script Proxy Execution

Tactic: Stealth
Platform: Windows
Version: 2.0
Created: 06 February 2024
Last modified: 12 May 2026
Contributor: Shaul Vilkomir-Preisman

Adversaries may abuse SyncAppvPublishingServer.vbs to proxy execution of malicious PowerShell commands. SyncAppvPublishingServer.vbs is a Visual Basic script associated with how Windows virtualizes applications (Microsoft Application Virtualization, or App-V).[1] For example, Windows may render Win32 applications to users as virtual applications, allowing users to launch and interact with them as if they were installed locally.[2][3] The SyncAppvPublishingServer.vbs script is legitimate, may be signed by Microsoft, and is commonly executed from \System32 through the command line via wscript.exe.[4][5]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Offense vs defense T1216.002

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

SyncAppvPublishingServer detection strategy DET0440

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detecting PowerShell Execution via SyncAppvPublishingServer.vbs Proxy Abuse

Enterprise

1 platform

AN1220 · Windows

Execution of SyncAppvPublishingServer.vbs through wscript.exe with a command-line containing embedded PowerShell, proxying malicious PowerShell execution through a Microsoft-signed VBScript interpreter to evade detection and restrictions.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Process AccessDC0035	WinEventLog:Sysmon	EventCode=10
Command ExecutionDC0064	WinEventLog:PowerShell	EventCode=4103, 4104, 4105, 4106

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CommandLineRegex	Detects embedded PowerShell commands in SyncAppvPublishingServer.vbs invocation, e.g., `{powershell -nop -enc ...}`
ScriptInterpreter	May vary between `wscript.exe`, `cscript.exe`, or called via `cmd.exe`
PowerShellObfuscationScore	Used to detect encoding, obfuscation, or entropy level in embedded PowerShell payloads
TimeWindow	Time delta between VBScript proxy invocation and PowerShell payload execution

Tests1Executorscmd 1Need elevation0 of 1Have prerequisites0Have cleanup0Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

SyncAppvPublishingServer Signed Script PowerShell Command Execution

windows

cmd

—

Executes the signed SyncAppvPublishingServer script with options to execute an arbitrary PowerShell command. Upon execution, calc.exe will be launched.

Input arguments

Name	Type	Default	Description
command_to_execute	string	Start-Process calc	A PowerShell command to execute.

Attack command

C:\windows\system32\SyncAppvPublishingServer.vbs "\n;#{command_to_execute}"

GUID8ae13c7e-f0a7-4374-b73e-81023abe5ba4

Tests from Atomic Red Team (MIT licence) · technique definition

SyncAppvPublishingServer detections T1216.002

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs