Certutil.exe Abused for Payload Decode/Download (Kimsuky Link.dat/Link.ini)

Ibrahim Saud@tektrix

•updated Jul 2, 2026•4•0•5

Detects the use of the Windows Certutil utility to decode files or extract items from the cache, specifically looking for indicators often associated with file reassembly or extraction of payload components such as Link.dat or Link.ini files.