Identifier / Programs / Windows
appcert.exe
Command Line Interface file version info (xCyclopedia)
LOLBAS Execute 2 ATT&CK techniques 2 documented commands 1 known copy with hashes
How appcert.exe is abused
Execute T1218.007 System Binary Proxy Execution: Msiexec
test
-apptype-setuppath-setupcommandline-q-reportoutputpathEach abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for appcert.exe.
2 documented commands
Execute T1127 Trusted Developer Utilities Proxy Execution Administrator privileges
Execute an executable file via the Windows App Certification Kit command-line tool.
appcert.exe test -apptype desktop -setuppath {PATH_ABSOLUTE:.exe} -reportoutputpath {PATH_ABSOLUTE:.xml}Execute T1218.007 System Binary Proxy Execution: Msiexec Administrator privileges
Install an MSI file via an msiexec instance spawned via appcert.exe as parent process.
appcert.exe test -apptype desktop -setuppath {PATH_ABSOLUTE:.msi} -setupcommandline /q -reportoutputpath {PATH_ABSOLUTE:.xml}None of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for appcert.exe, by Avihay Eldad, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for appcert.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real appcert.exe?
Logotest.exe in the file’s header: a renamed copy still carries itC:\Program Files (x86)\Windows Kits\10\App Certification Kit\1 known copy
10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\App Certification Kit\appcert.exe · signed by Microsoft Corporation
1c94217acd0b918409170b3764bc3b5771c1c2de2dafcb09b5e7d9bff9c226b4From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.