LOL · OtherMSBinary

AppCert.exe

2 techniques WindowsLOLBAS GPL-3.0

Execute

Execution Windows

Execute an executable file via the Windows App Certification Kit command-line tool.

Use Performs execution of specified file, can be used as a defense evasion

appcert.exe test -apptype desktop -setuppath {PATH_ABSOLUTE:.exe} -reportoutputpath {PATH_ABSOLUTE:.xml}

Context: admin
Native: Execute
MITRE: T1127
Refs: learn.microsoft.com/windows/win32/win_cert/using-the-windows-app-certification-kit
lolbas-project.github.io/lolbas/OtherMSBinaries/AppCert/

Execution Windows

Install an MSI file via an msiexec instance spawned via appcert.exe as parent process.

Use Execute custom made MSI file with malicious code

appcert.exe test -apptype desktop -setuppath {PATH_ABSOLUTE:.msi} -setupcommandline /q -reportoutputpath {PATH_ABSOLUTE:.xml}

Context: admin
Native: Execute
MITRE: T1218.007
Refs: learn.microsoft.com/windows/win32/win_cert/using-the-windows-app-certification-kit
lolbas-project.github.io/lolbas/OtherMSBinaries/AppCert/