File Decoded From Base64/Hex Via Certutil.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 28, 2025•1•0•16

Detects the execution of certutil.exe with the "-decode" or "-decodehex" flags to decode base64 or hex encoded files. This technique is commonly abused by attackers to deobfuscate and prepare encoded payloads for execution, often as part of defense evasion tactics.