From a945bac6be173393c1b9a2a77e5130ad7cfdb36d Mon Sep 17 00:00:00 2001
From: Avihay Eldad <46644022+avihayeldad@users.noreply.github.com>
Date: Sun, 31 Mar 2024 20:56:11 +0300
Subject: [PATCH] Create Appcert.yml (#361)

Co-authored-by: Wietze <wietze@users.noreply.github.com>
---
 yml/OtherMSBinaries/Appcert.yml | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)
 create mode 100644 yml/OtherMSBinaries/Appcert.yml

diff --git a/yml/OtherMSBinaries/Appcert.yml b/yml/OtherMSBinaries/Appcert.yml
new file mode 100644
index 0000000..30b817b
--- /dev/null
+++ b/yml/OtherMSBinaries/Appcert.yml
@@ -0,0 +1,28 @@
+---
+Name: AppCert.exe
+Description: Windows App Certification Kit command-line tool.
+Author: Avihay Eldad
+Created: 2024-03-06
+Commands:
+  - Command: appcert.exe test -apptype desktop -setuppath c:\windows\system32\notepad.exe -reportoutputpath c:\users\public\output.xml
+    Description: Execute an executable file via the Windows App Certification Kit command-line tool.
+    Usecase: Performs execution of specified file, can be used as a defense evasion
+    Category: Execute
+    Privileges: Administrator
+    MitreID: T1127
+    OperatingSystem: Windows
+  - Command: appcert.exe test -apptype desktop -setuppath c:\users\public\malicious.msi -setupcommandline /q -reportoutputpath c:\users\public\output.xml
+    Description: Install an MSI file via an msiexec instance spawned via appcert.exe as parent process.
+    Usecase: Execute custom made MSI file with malicious code
+    Category: Execute
+    Privileges: Administrator
+    MitreID: T1218.007
+    OperatingSystem: Windows
+Full_Path:
+  - Path: C:\Program Files (x86)\Windows Kits\10\App Certification Kit\appcert.exe
+  - Path: C:\Program Files\Windows Kits\10\App Certification Kit\appcert.exe
+Resources:
+  - Link: https://learn.microsoft.com/windows/win32/win_cert/using-the-windows-app-certification-kit
+Acknowledgement:
+  - Person: Avihay Eldad
+    Handle: '@AvihayEldad'