Certutil Decode and WScript Execution of Staged Link.dat/Link.ini Payload

Ibrahim Saud@tektrix

•updated Jul 2, 2026•2•0•12

This rule detects potentially malicious behavior involving the abuse of legitimate Windows binaries 'certutil.exe' and 'wscript.exe'. It flags specific command-line patterns often associated with deobfuscating, decoding, or staging payloads, such as using certutil to decode files or interact with web caches, and using wscript to execute vbscript from suspicious files like 'Link.ini' or 'Link.dat'.