Windows App Certification Kit command-line tool. Located at: C:\Program Files (x86)\Windows Kits\10\App Certification Kit\appcert.exe; C:\Program Files\Windows Kits\10\App Certification Kit\appcert.exe.
appcertappcertSandbox: execFile · Timeout: 30s
security.execution.command Outputs
process.output Command execution output
process_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Execute an executable file via the Windows App Certification Kit command-line tool. (Performs execution of specified file, can be used as a defense evasion)
appcert.exe test -apptype desktop -setuppath {PATH_ABSOLUTE:.exe} -reportoutputpath {PATH_ABSOLUTE:.xml}Install an MSI file via an msiexec instance spawned via appcert.exe as parent process. (Execute custom made MSI file with malicious code)
appcert.exe test -apptype desktop -setuppath {PATH_ABSOLUTE:.msi} -setupcommandline /q -reportoutputpath {PATH_ABSOLUTE:.xml}appcert is a Windows LOLBin. Windows App Certification Kit command-line tool. Located at: C:\Program Files (x86)\Windows Kits\10\App Certification Kit\appcert.exe; C:\Program Files\Windows Kits\10\App Certification Kit\appcert.exe.