appvlp.exe

appvlp file version info (xCyclopedia)

LOLBAS Execute 6 Sigma rules name it 1 ATT&CK technique 2 documented commands 1 known copy with hashes

How appvlp.exe is abused

documented by LOLBAS

Execute T1218 System Binary Proxy Execution

-c

-comobject

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for appvlp.exe.

2 documented commands

from LOLBAS, each read by the identifier

Execute T1218 System Binary Proxy Execution User privileges

Executes .bat file through AppVLP.exe

AppVLP.exe {PATH_SMB:.bat}

Identify

Execute T1218 System Binary Proxy Execution User privileges

Executes powershell.exe as a subprocess of AppVLP.exe and run the respective PS command.

AppVLP.exe powershell.exe -c "$e=New-Object -ComObject shell.application;$e.ShellExecute('{PATH:.exe}','', '', 'open', 1)"

Identify

None of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for appvlp.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for appvlp.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

highSuspicious Shells Spawn by Java Utility KeytoolAndreas Hunkeler (@Karneades)

highSuspicious Child Process Of Manage Engine ServiceDeskFlorian Roth (Nextron Systems)

highSuspicious Processes Spawned by Java.EXEAndreas Hunkeler (@Karneades), Florian Roth

highSuspicious Microsoft OneNote Child ProcessTim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea)

highSuspicious Outlook Child ProcessMichael Haag, Florian Roth (Nextron Systems), Markus Neis, Elastic, FPT.EagleEye Team

highSuspicious Microsoft Office Child ProcessFlorian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io

T1218System Binary Proxy Execution

Is it the real appvlp.exe?

file version info and known copies

Installed inC:\Program Files (x86)\Microsoft Office\root\Client\

Signed byMicrosoft Corporation

ProductMicrosoft Application Virtualization (App-V), Microsoft Corporation

Descriptionappvlp

1 known copy

5.1.145.0 · C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe · signed by Microsoft Corporation

234317e8ff5cb4c2fa2808c63abbb6ce7641b935c74d50ac63355fece4f6dd75

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.