Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1216.002sub-technique of T1216 System Script Proxy Execution

SyncAppvPublishingServer

Windowsnothing on this site yetT1216.002 on attack.mitre.org

Adversaries may abuse SyncAppvPublishingServer.vbs to proxy execution of malicious PowerShell commands. SyncAppvPublishingServer.vbs is a Visual Basic script associated with how Windows virtualizes applications (Microsoft Application Virtualization, or App-V). For example, Windows may render Win32 applications to users as virtual applications, allowing users to launch and interact with them as if they were installed locally.

MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Detecting PowerShell Execution via SyncAppvPublishingServer.vbs Proxy Abuse

  • Execution of SyncAppvPublishingServer.vbs through wscript.exe with a command-line containing embedded PowerShell, proxying malicious PowerShell execution through a Microsoft-signed VBScript interpreter to evade detection and restrictions.

what reduces it

  • M1038 Execution Prevention. Certain signed scripts that can be used to execute other programs may not be necessary within a given environment. Use application control configured to block execution of these scripts if they are not required for a given system or network to prevent potential misuse by adversaries.

the rest of T1216

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.