Elastic Defend high stable eql

Execution via SyncAppvPublishingServer

Identifies the execution of powershell command via a Microsoft signed Visual Basic script Syncappvpublishingserver.vbs. Adversaries may use this method to bypass application whitelisting.

View Source

Detection Logic

process where event.action == "start" and
(
 (process.pe.original_file_name : ("wscript.exe", "cscript.exe", "cmd.exe") and
  process.command_line : "*SyncAppvPublishingServer.vbs*" and process.args : ("n;*", ";*", "Break;*")) or

  (process.name : "powershell.exe" and process.args : "Sync-AppvPublishingServer" and process.args : ("n;*", ";*", "Break;*"))
)

Field Validations

Loading…

Comments (0)

Loading comments...