CertUtil Remote Download or Base64 Decode Abuse

Ankit Mehta@Secvyn

•updated Jun 27, 2026•0•0•1

Detects the suspicious use of the legitimate Windows utility CertUtil.exe for downloading files from remote URLs or for encoding/decoding files. These actions are common techniques used by adversaries to bypass security controls, download malicious payloads, or obfuscate staging files.