Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1216.002_syncappvpublishingserver
Adversaries may abuse SyncAppvPublishingServer.vbs to proxy execution of malicious PowerShell commands.
Passed 22 of 22 test cases with the skill, and 18 of 22 without it.
and 3 more in the full report
4 fixed18 passed either way0 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 4 test cases the skill fixed. Same model, same prompt, with and without the skill.
We are mapping Windows LOLBAS utilities to MITRE ATT&CK. Analysts are arguing whether SyncAppvPublishingServer.vbs falls under T1218 (Signed Binary Proxy Execution) or T1216 (System Script Proxy Execution). What is the exact parent technique ID and sub-technique ID for SyncAppvPublishingServer proxy execution?
| Checked | Without skill | With skill |
|---|---|---|
| Identify T1216 as the parent technique ID. | Passed | Passed |
| Identify T1216.002 as the specific sub-technique ID. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1216
Adversaries may abuse SyncAppvPublishingServer.vbs to proxy execution of malicious PowerShell commands. SyncAppvPublishingServer.vbs is a Visual Basic script associated with how Windows virtualizes applications (Microsoft Application Virtualization, or App-V). For example, Windows may render Win32 applications to users as virtual applications, allowing users to launch and interact with them as if they were installed locally.
The SyncAppvPublishingServer.vbs script is legitimate, may be signed by Microsoft, and is commonly executed from \System32 through the command line via wscript.exe.
Adversaries may abuse SyncAppvPublishingServer.vbs to bypass PowerShell execution restrictions and evade defensive counter measures by "living off the land." Proxying execution may function as a trusted/signed alternative to directly invoking powershell.exe.
For example, PowerShell commands may be invoked using:
SyncAppvPublishingServer.vbs "n; {PowerShell}"
Platforms: Windows
Identify Attack Surface: Determine if the target environment is susceptible to SyncAppvPublishingServer by examining the target platforms (Windows).
Assess Existing Defenses: Review whether mitigations for T1216.002 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 18 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.