Suspicious File Encoded To Base64 Via Certutil.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 28, 2025•1•0•16

Detects the execution of certutil.exe with the "-encode" flag to encode a file to base64, specifically when the file has a suspicious extension. This activity can be indicative of an adversary attempting to obfuscate malicious files or exfiltrate data.