From f4cd4d0bd1b8db6f67c783f716874c1b2c5ab071 Mon Sep 17 00:00:00 2001
From: hegusung <7390383+hegusung@users.noreply.github.com>
Date: Sun, 13 Oct 2024 21:25:16 +0200
Subject: [PATCH] Update Appcert.yml Tags

Added Tags:
Execute EXE
Execute MSI
---
 yml/OtherMSBinaries/Appcert.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/yml/OtherMSBinaries/Appcert.yml b/yml/OtherMSBinaries/Appcert.yml
index 30b817b..a423ff3 100644
--- a/yml/OtherMSBinaries/Appcert.yml
+++ b/yml/OtherMSBinaries/Appcert.yml
@@ -11,6 +11,8 @@ Commands:
     Privileges: Administrator
     MitreID: T1127
     OperatingSystem: Windows
+    Tags:
+      - Execute: EXE
   - Command: appcert.exe test -apptype desktop -setuppath c:\users\public\malicious.msi -setupcommandline /q -reportoutputpath c:\users\public\output.xml
     Description: Install an MSI file via an msiexec instance spawned via appcert.exe as parent process.
     Usecase: Execute custom made MSI file with malicious code
@@ -18,6 +20,8 @@ Commands:
     Privileges: Administrator
     MitreID: T1218.007
     OperatingSystem: Windows
+    Tags:
+      - Execute: MSI
 Full_Path:
   - Path: C:\Program Files (x86)\Windows Kits\10\App Certification Kit\appcert.exe
   - Path: C:\Program Files\Windows Kits\10\App Certification Kit\appcert.exe