Certutil.exe LOLBin Remote File Download (T1105)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•0

Detects usage of the built-in Windows utility 'certutil.exe' with parameters commonly used to download files from remote URLs, such as '-urlcache' or '-verifyctl'. This behavior is frequently exploited by adversaries to perform ingress tool transfer and fetch malicious payloads.