Adversaries may abuse SyncAppvPublishingServer.vbs to proxy execution of malicious [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands. SyncAppvPublishingServer.vbs is a Visual Basic script associated with how Windows virtualizes applications (Microsoft Application Virtualization, or App-V).(Citation: 1 - appv) For example, Windows may render Win32 applications to users as virtual applications, allowing users to launch and interact with them as if they were installed locally.(Citation: 2 - appv)(Citation: 3 - appv)
    
The SyncAppvPublishingServer.vbs script is legitimate, may be signed by Microsoft, and is commonly executed from `\System32` through the command line via `wscript.exe`.(Citation: 4 - appv)(Citation: 5 - appv)

Adversaries may abuse SyncAppvPublishingServer.vbs to bypass [PowerShell](https://attack.mitre.org/techniques/T1059/001) execution restrictions and evade defensive counter measures by "living off the land."(Citation: 6 - appv)(Citation: 4 - appv) Proxying execution may function as a trusted/signed alternative to directly invoking `powershell.exe`.(Citation: 7 - appv)

For example,  [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands may be invoked using:(Citation: 5 - appv)

`SyncAppvPublishingServer.vbs "n; {PowerShell}"`
SyncAppvPublishingServer
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1216/002  external_id: T1216.002     source_name: 4 - appv  description: John Fokker. (2022, March 17). Suspected DarkHotel APT activity update. Retrieved February 6, 2024.  url: https://www.trellix.com/en-ca/about/newsroom/stories/research/suspected-darkhotel-apt-activity-update/     source_name: 2 - appv  description: Microsoft. (2022, November 3). Getting started with App-V for Windows client. Retrieved February 6, 2024.  url: https://learn.microsoft.com/en-us/windows/application-management/app-v/appv-getting-started     source_name: 5 - appv  description: Nick Landers, Casey Smith. (n.d.). /Syncappvpublishingserver.vbs. Retrieved February 6, 2024.  url: https://lolbas-project.github.io/lolbas/Scripts/Syncappvpublishingserver/     source_name: 7 - appv  description: Nick Landers. (2017, August 8). Need a signed alternative to Powershell.exe? SyncAppvPublishingServer in Win10 has got you covered.. Retrieved February 6, 2024.  url: https://twitter.com/monoxgas/status/895045566090010624     source_name: 3 - appv  description: Raj Chandel. (2022, March 17). Indirect Command Execution: Defense Evasion (T1202). Retrieved February 6, 2024.  url: https://www.hackingarticles.in/indirect-command-execution-defense-evasion-t1202/     source_name: 1 - appv  description: SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.  url: https://securelist.com/bluenoroff-methods-bypass-motw/108383/     source_name: 6 - appv  description: Strontic. (n.d.). SyncAppvPublishingServer.exe. Retrieved February 6, 2024.  url: https://strontic.github.io/xcyclopedia/library/SyncAppvPublishingServer.exe-3C291419F60CDF9C2E4E19AD89944FA3.html     