
title: Using AppVLP To Circumvent ASR File Path Rule
author: Sreeman
date: 2020/03/13
description: Application Virtualization Utility is included with Microsoft Office.We
  are able to abuse “AppVLP” to execute shell commands. Normally, this binary is used
  for Application Virtualization, but we can use it as an abuse binary to circumvent
  the ASR file path rule folder or to mark a file as a system file
detection:
  SELECTION_1:
    CommandLine|re: (?i).*appvlp.exe.*(cmd.exe|powershell.exe).*(.sh|.exe|.dll|.bin|.bat|.cmd|.js|.msh|.reg|.scr|.ps|.vb|.jar|.pl|.inf)
  condition: SELECTION_1
falsepositives:
- unknown
fields:
- ParentProcess
- CommandLine
- ParentCommandLine
id: 9c7e131a-0f2c-4ae0-9d43-b04f4e266d43
level: medium
logsource:
  product: windows
  service: security
modified: 2021/06/11
status: experimental
tags:
- attack.t1218
- attack.defense_evasion
- attack.execution
ruletype: SIGMA
