CertUtil Payload Download Pattern

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects HTTP traffic where the User-Agent header contains the string 'CertUtil' (case-insensitive). This pattern is often associated with adversaries using the Windows built-in utility CertUtil to download malicious payloads, a common technique for defense evasion.