Detect Uncommon Child Processes Spawned by Appvlp.EXE on Windows

title: Detect Uncommon Child Processes Spawned by Appvlp.EXE on Windows
id: 964f815a-44b2-41f6-811c-4ad6b6968243
status: test
description: This rule identifies rare process executions where the parent process is Appvlp.EXE and the spawned child image does not match several common rundll32 and Microsoft Office-related binaries. Abuse of AppVLP can enable attackers to execute shell commands or help bypass Windows controls, making unexpected child processes a useful indicator. It relies on Windows process creation telemetry, specifically the parent process path ending with \appvlp.exe and the child process image path patterns.
references:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Appvlp/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_appvlp_uncommon_child_process.yml
author: Sreeman, Huntrule Team
date: 2020-03-13
modified: 2023-11-09
tags:
  - attack.stealth
  - attack.t1218
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \appvlp.exe
  filter_main_generic:
    Image|endswith:
      - :\Windows\SysWOW64\rundll32.exe
      - :\Windows\System32\rundll32.exe
  filter_optional_office_msoasb:
    Image|contains: :\Program Files\Microsoft Office
    Image|endswith: \msoasb.exe
  filter_optional_office_skype:
    Image|contains|all:
      - :\Program Files\Microsoft Office
      - \SkypeSrv\
    Image|endswith: \SKYPESERVER.EXE
  filter_optional_office_msouc:
    Image|contains: :\Program Files\Microsoft Office
    Image|endswith: \MSOUC.EXE
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 9c7e131a-0f2c-4ae0-9d43-b04f4e266d43
    type: derived