All Detections

Suspicious File Downloaded From Direct IP Via Certutil.EXE

avatar
SigmaHQ Detections@sigmaHQ
updated Apr 28, 2026000

Detects the execution of certutil with certain flags that allow the utility to download files from direct IPs.

Sigma