Certutil Abuse for Encoding, Decoding, or Remote File Download
Detects the use of certutil.exe for potentially malicious activities including file encoding/decoding and downloading files from the internet. Attackers often abuse this legitimate Windows utility to deobfuscate payloads or pull malicious files onto a target system.
SentinelOne
