.. /AppCert.exe

Star

Paths:

• C:\Program Files (x86)\Windows Kits\10\App Certification Kit\appcert.exe
• C:\Program Files\Windows Kits\10\App Certification Kit\appcert.exe

Resources:

• https://learn.microsoft.com/windows/win32/win_cert/using-the-windows-app-certification-kit

Acknowledgements:

• Avihay Eldad (@AvihayEldad)

Execute

1. Execute an executable file via the Windows App Certification Kit command-line tool.

   appcert.exe test -apptype desktop -setuppath c:\windows\system32\notepad.exe -reportoutputpath c:\users\public\output.xml

   Use case

   Performs execution of specified file, can be used as a defense evasion

   Privileges required

   Administrator

   Operating systems

   Windows

   ATT&CK® technique

   T1127

2. Install an MSI file via an msiexec instance spawned via appcert.exe as parent process.

   appcert.exe test -apptype desktop -setuppath c:\users\public\malicious.msi -setupcommandline /q -reportoutputpath c:\users\public\output.xml

   Use case

   Execute custom made MSI file with malicious code

   Privileges required

   Administrator

   Operating systems

   Windows

   ATT&CK® technique

   T1218.007