Certutil Download Launched from Web Application Context

Ankit Mehta@Secvyn

•updated Aug 5, 2026•3•1•2

This rule detects the use of the Windows utility 'certutil.exe' to download external files, executed from the context of common web server or application processes (e.g., w3wp.exe, nginx.exe). This pattern is a common technique used by attackers to stage malicious payloads or tools in publicly accessible or temporary directories after initial web-based compromise.