Potential NTLM Coercion Via Certutil.EXE
This rule detects potential NTLM coercion attempts using the built-in Windows utility 'certutil.exe'. Specifically, it looks for command-line executions of 'certutil.exe' that include both the '-syncwithWU' flag and a UNC path (indicated by '\\'). This combination is known to be abused by attackers to force a Windows machine to authenticate to an attacker-controlled server, thereby coercing it to send its NTLM hash.
Sigma
