VLC (vlc.exe) spawning unexpected child process post-exploitation

Ankit Mehta@Secvyn

•updated 27 days ago•3•0•5

Detects instances where the VLC Media Player process (vlc.exe) acts as the parent to common LOLBAS (Living Off the Land Binary and Script) executables such as cmd.exe, powershell.exe, and others. This pattern is often indicative of exploitation attempts or malicious activity where a compromised or trojanized application triggers secondary payloads.