LOL · OtherMSBinary

AppCert.exe

2 techniquesWindowsLOLBASGPL-3.0

Execute

ExecutionWindows

Execute an executable file via the Windows App Certification Kit command-line tool.

Use Performs execution of specified file, can be used as a defense evasion

appcert.exe test -apptype desktop -setuppath {PATH_ABSOLUTE:.exe} -reportoutputpath {PATH_ABSOLUTE:.xml}

Evidence: Upstream reference
Environment: Local host
Context: admin
Native: Execute
MITRE: T1127
Refs: learn.microsoft.com/windows/win32/win_cert/using-the-windows-app-certification-kit
lolbas-project.github.io/lolbas/OtherMSBinaries/AppCert/

ExecutionWindows

Install an MSI file via an msiexec instance spawned via appcert.exe as parent process.

Use Execute custom made MSI file with malicious code

appcert.exe test -apptype desktop -setuppath {PATH_ABSOLUTE:.msi} -setupcommandline /q -reportoutputpath {PATH_ABSOLUTE:.xml}

Evidence: Upstream reference
Environment: Local host
Context: admin
Native: Execute
MITRE: T1218.007
Refs: learn.microsoft.com/windows/win32/win_cert/using-the-windows-app-certification-kit
lolbas-project.github.io/lolbas/OtherMSBinaries/AppCert/