File Encoded To Base64 Via Certutil.EXE From Suspicious Location

SigmaHQ Detections@sigmaHQ

•updated Aug 28, 2025•1•0•14

Detects the execution of `certutil.exe` with the "-encode" flag to encode a file to Base64. This rule specifically triggers when the input file is located in potentially suspicious directories such as `AppData\Roaming\`, `Desktop\`, `Local\Temp\`, `PerfLogs\`, `Users\Public\`, `Windows\Temp\`, or `$Recycle.Bin`. This activity is often indicative of defense evasion, where attackers obfuscate malicious payloads to bypass security controls or hide their activities.