Certutil Self-Decoding Batch Script

Ethan Andrews@eandrews

•updated Feb 25, 2026•5•0•78

Detects the use of certutil.exe to decode a batch script that is referencing itself as the source file. This is a 'fileless' technique used by attackers to hide and extract embedded payloads, as seen in the 'Contagious Interview' campaign.