AppCert.exe

Windows App Certification Kit command-line tool.

Execute

Performs execution of specified file, can be used as a defense evasion

appcert.exe test -apptype desktop -setuppath {PATH_ABSOLUTE:.exe} -reportoutputpath {PATH_ABSOLUTE:.xml}

Execute an executable file via the Windows App Certification Kit command-line tool. — MITRE: T1127 — Privileges: Administrator

Execute custom made MSI file with malicious code

appcert.exe test -apptype desktop -setuppath {PATH_ABSOLUTE:.msi} -setupcommandline /q -reportoutputpath {PATH_ABSOLUTE:.xml}

Install an MSI file via an msiexec instance spawned via appcert.exe as parent process. — MITRE: T1218.007 — Privileges: Administrator