public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2025-11-04 02:29:34 +01:00
Code Issues Projects Releases Wiki Activity

Create Appcert.yml (#361)

Browse Source 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
This commit is contained in:
Avihay Eldad
2024-03-31 20:56:11 +03:00
committed by GitHub
parent 33b9574d04
commit a945bac6be
1 changed files with 28 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
yml/OtherMSBinaries/Appcert.yml Normal file
View File

@@ -0,0 +1,28 @@
---
Name: AppCert.exe
Description: Windows App Certification Kit command-line tool.
Author: Avihay Eldad
Created: 2024-03-06
Commands:
- Command: appcert.exe test -apptype desktop -setuppath c:\windows\system32\notepad.exe -reportoutputpath c:\users\public\output.xml
Description: Execute an executable file via the Windows App Certification Kit command-line tool.
Usecase: Performs execution of specified file, can be used as a defense evasion
Category: Execute
Privileges: Administrator
MitreID: T1127
OperatingSystem: Windows
- Command: appcert.exe test -apptype desktop -setuppath c:\users\public\malicious.msi -setupcommandline /q -reportoutputpath c:\users\public\output.xml
Description: Install an MSI file via an msiexec instance spawned via appcert.exe as parent process.
Usecase: Execute custom made MSI file with malicious code
Category: Execute
Privileges: Administrator
MitreID: T1218.007
OperatingSystem: Windows
Full_Path:
- Path: C:\Program Files (x86)\Windows Kits\10\App Certification Kit\appcert.exe
- Path: C:\Program Files\Windows Kits\10\App Certification Kit\appcert.exe
Resources:
- Link: https://learn.microsoft.com/windows/win32/win_cert/using-the-windows-app-certification-kit
Acknowledgement:
- Person: Avihay Eldad
Handle: '@AvihayEldad'