Certutil.exe Downloading File From Direct IP

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

Detects the execution of certutil.exe with specific flags ('urlcache' or 'verifyctl') to download files from direct IP addresses. This technique is often used by adversaries for ingress tool transfer or to retrieve malicious payloads, bypassing traditional web proxies or security controls that might monitor domain-based traffic.