Uncommon Child Process Of Appvlp.EXE
Detects uncommon child processes spawned by Appvlp.EXE. Appvlp.EXE, or Application Virtualization Utility, is part of Microsoft Office and can be abused by attackers to execute shell commands, bypass ASR file path rules, or mark files as system files. This rule specifically looks for child processes that are not commonly associated with legitimate Appvlp.EXE operations, such as rundll32.exe, msoasb.exe, skypeserver.exe, and msouc.exe.
Sigma
