Certutil -decode of Base64 Payload Disguised as .ini via PowerShell/Wscript Chain (Kimsuky CHM Tradecraft)

Ibrahim Saud@tektrix

•updated Jul 2, 2026•0•0•13

This rule detects potential malicious activity where PowerShell is used to write base64-encoded files disguised with non-script extensions (e.g., .ini), which are subsequently decoded using 'certutil.exe -decode' and executed via 'wscript.exe'. This chain is a common technique used to bypass security controls by obfuscating script content and utilizing legitimate system binaries for deobfuscation and execution.