proc_creation_win_certutil_encode

SigmaHQ Detections@sigmaHQ

•updated Aug 28, 2025•1•0•12

Detects the execution of certutil with the "encode" flag to encode a file to base64. This can be abused by threat actors and attackers for data exfiltration