Certutil Abused for Payload Decode or Download
Detects the execution of Certutil.exe with specific command-line arguments (-decode, -urlcache, -split) or references to suspicious file patterns (Link.dat, Link.ini) which are often indicative of malicious activity such as downloading remote payloads, decoding obfuscated binaries, or staging files for lateral movement.
Sigma
