LOLBAS. GitHub
LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

AppCert.exe

View source

Windows App Certification Kit command-line tool.

Execute
02COMMAND EXAMPLES
02ATT&CK TECHNIQUES
00DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Execute2

EXAMPLE 01T1127

Execute an executable file via the Windows App Certification Kit command-line tool.

COMMAND
appcert.exe test -apptype desktop -setuppath {PATH_ABSOLUTE:.exe} -reportoutputpath {PATH_ABSOLUTE:.xml}
USE CASE
Performs execution of specified file, can be used as a defense evasion
PRIVILEGES
Administrator
OPERATING SYSTEM
Windows
Execute · EXE
EXAMPLE 02T1218.007

Install an MSI file via an msiexec instance spawned via appcert.exe as parent process.

COMMAND
appcert.exe test -apptype desktop -setuppath {PATH_ABSOLUTE:.msi} -setupcommandline /q -reportoutputpath {PATH_ABSOLUTE:.xml}
USE CASE
Execute custom made MSI file with malicious code
PRIVILEGES
Administrator
OPERATING SYSTEM
Windows
Execute · MSI
02 / ON DISK

Known paths

C:\Program Files (x86)\Windows Kits\10\App Certification Kit\appcert.exe
C:\Program Files\Windows Kits\10\App Certification Kit\appcert.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

0 resources

No detection resources documented yet.

Contribute detection coverage
FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Avihay Eldad@AvihayEldad