CertUtil Decode Used to Extract Payload
This rule detects HTTP traffic where the URI contains both 'certutil' and '-decode' (case-insensitive). This pattern is indicative of an attacker using the Windows built-in 'certutil.exe' utility to decode a file downloaded via HTTP, often as part of a defense evasion or payload extraction technique. The 'flow:to_server,established' indicates that the detection is looking for this pattern in requests going from the internal network to an external server, suggesting a client-initiated download or interaction.
Suricata
