T1216.002

Description from ATT&CK

Adversaries may abuse SyncAppvPublishingServer.vbs to proxy execution of malicious PowerShell commands. SyncAppvPublishingServer.vbs is a Visual Basic script associated with how Windows virtualizes applications (Microsoft Application Virtualization, or App-V).(Citation: 1 - appv) For example, Windows may render Win32 applications to users as virtual applications, allowing users to launch and interact with them as if they were installed locally.(Citation: 2 - appv)(Citation: 3 - appv)

The SyncAppvPublishingServer.vbs script is legitimate, may be signed by Microsoft, and is commonly executed from \System32 through the command line via wscript.exe.(Citation: 4 - appv)(Citation: 5 - appv)

Adversaries may abuse SyncAppvPublishingServer.vbs to bypass PowerShell execution restrictions and evade defensive counter measures by "living off the land."(Citation: 6 - appv)(Citation: 4 - appv) Proxying execution may function as a trusted/signed alternative to directly invoking powershell.exe.(Citation: 7 - appv)

For example, PowerShell commands may be invoked using:(Citation: 5 - appv)

SyncAppvPublishingServer.vbs "n; {PowerShell}"

Source

Atomic Tests

• Atomic Test #1: SyncAppvPublishingServer Signed Script PowerShell Command Execution

Atomic Test #1: SyncAppvPublishingServer Signed Script PowerShell Command Execution

Executes the signed SyncAppvPublishingServer script with options to execute an arbitrary PowerShell command. Upon execution, calc.exe will be launched.

Supported Platforms: Windows

auto_generated_guid: 275d963d-3f36-476c-8bef-a2a3960ee6eb

Inputs

Attack Commands: Run with command_prompt!

C:\windows\system32\SyncAppvPublishingServer.vbs "\n;#{command_to_execute}"

Atomic test(s) for this technique last updated: 2026-08-17 03:06:46 UTC