T1216.002 — SyncAppvPublishingServer

T1216.002 System Script Proxy Execution: SyncAppvPublishingServer

title: "T1216.002 System Script Proxy Execution: SyncAppvPublishingServer"
id: e24adfc9-26fe-4d62-b2a1-5eba16faec88
description: 'Detects PowerShell/cscript/wscript execution referencing SyncAppvPublishingServer.vbs, a legitimate signed App-V script whose -PublishingServerUrl parameter can be abused to proxy execution of arbitrary PowerShell commands. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: CommandLineRegex, ScriptInterpreter, PowerShellObfuscationScore, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1216/002
author: Shahrukh Khan
date: 2026-06-14
license: MIT
tags:
  - attack.stealth
  - attack.t1216.002

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    EventID: 1
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cscript.exe'
      - '\wscript.exe'
    CommandLine|contains: 'SyncAppvPublishingServer.vbs'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Legitimate App-V publishing server synchronization in environments using Microsoft Application Virtualization.

level: medium