kevmap

TechniquesT1216.002 › AN1220

AN1220 Analytic 1220

Windows · attack.mitre.org · ATT&CK Enterprise v19.2

<p>Execution of SyncAppvPublishingServer.vbs through wscript.exe with a command-line containing embedded PowerShell, proxying malicious PowerShell execution through a Microsoft-signed VBScript interpreter to evade detection and restrictions.</p>
Detects
T1216.002 SyncAppvPublishingServer
Part of
DET0440 Detecting PowerShell Execution via SyncAppvPublishingServer.vbs Proxy Abuse

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log sourceChannelData component
WinEventLog:SysmonEventCode=1DC0032 Process Creation
WinEventLog:PowerShellEventCode=4103, 4104, 4105, 4106DC0064 Command Execution
WinEventLog:SysmonEventCode=7DC0016 Module Load
WinEventLog:SysmonEventCode=10DC0035 Process Access

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

FieldDescription
CommandLineRegexDetects embedded PowerShell commands in SyncAppvPublishingServer.vbs invocation, e.g., `{powershell -nop -enc ...}`
ScriptInterpreterMay vary between `wscript.exe`, `cscript.exe`, or called via `cmd.exe`
PowerShellObfuscationScoreUsed to detect encoding, obfuscation, or entropy level in embedded PowerShell payloads
TimeWindowTime delta between VBScript proxy invocation and PowerShell payload execution