diff --git a/yml/OtherMSBinaries/AppLauncher.yml b/yml/OtherMSBinaries/AppLauncher.yml new file mode 100644 index 0000000..05cf3bc --- /dev/null +++ b/yml/OtherMSBinaries/AppLauncher.yml @@ -0,0 +1,23 @@ +--- +Name: AppLauncher.exe +Description: User Experience Virtualization tool that launches applications under monitoring to capture and synchronize user settings. +Author: Avihay Eldad +Created: 2025-09-21 +Commands: + - Command: AppLauncher.exe {PATH_ABSOLUTE:.exe} + Description: Launches an executable via User Experience Virtualization tool. + Usecase: Executes an executable under a trusted, Microsoft signed binary. + Category: Execute + Privileges: User + MitreID: T1127 + OperatingSystem: Windows + Tags: + - Execute: EXE +Full_Path: + - Path: C:\Program Files\Windows Kits\10\Microsoft User Experience Virtualization\Management\AppLauncher.exe + - Path: C:\Program Files (x86)\Windows Kits\10\Microsoft User Experience Virtualization\Management\AppLauncher.exe +Resources: + - Link: https://learn.microsoft.com/en-us/microsoft-desktop-optimization-pack/ue-v/uev-getting-started +Acknowledgement: + - Person: Avihay Eldad + Handle: '@AvihayEldad'