Suspicious Certutil Decode via PowerShell with Hidden Window

Brandon Rodriguez@BMRodriguez

•updated May 21, 2026•3•0•233

Detects PowerShell executing certutil.exe to decode base64 files, specifically when a hidden window style is used. This behavior is indicative of the JSE dropper routine employed by the Kimsuky threat group to decode malicious payloads to disk.