AN1220
Analytic 1220
Windows
Execution of SyncAppvPublishingServer.vbs through wscript.exe with a command-line containing embedded PowerShell, proxying malicious PowerShell execution through a Microsoft-signed VBScript interpreter to evade detection and restrictions.
WinEventLog:Sysmon
EventCode=1
WinEventLog:PowerShell
EventCode=4103, 4104, 4105, 4106
WinEventLog:Sysmon
EventCode=7
WinEventLog:Sysmon
EventCode=10
[CommandLineRegex]
Detects embedded PowerShell commands in SyncAppvPublishingServer.vbs invocation, e.g., `{powershell -nop -enc ...}`
[ScriptInterpreter]
May vary between `wscript.exe`, `cscript.exe`, or called via `cmd.exe`
[PowerShellObfuscationScore]
Used to detect encoding, obfuscation, or entropy level in embedded PowerShell payloads
[TimeWindow]
Time delta between VBScript proxy invocation and PowerShell payload execution