Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
141 detections
Filters
Last updated
All Time
Detection languages
53
43
14
13
8
Contributors
34
28
16
10
8
Categories
102
100
43
23
13
Platforms
141
4
1
1
Products / Services
46
40
29
10
10
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
CVEs
2
2
2
2
1
IDS Classtypes
1
IDS Protocols
1
Detects the use of legitimate Windows system utilities certutil.exe and bitsadmin.exe to perform remote file downloads or decode remote content. Adversaries often use these dual-use tools to bypass network security controls by masquerading as standard system processes for staging second-stage payloads.
Detects the use of legitimate Windows binaries (certutil.exe and bitsadmin.exe) to download files from remote URLs to sensitive or common staging directories (Temp, AppData, ProgramData). Attackers frequently abuse these built-in tools for 'living off the land' (LotL) to retrieve malicious payloads or secondary tools while bypassing traditional signature-based detection.
Detects the abuse of the built-in Windows utility 'certutil.exe' to download remote files using URL cache functionality or to deobfuscate base64-encoded payloads. This is a common LOLBin (Living-off-the-Land Binary) technique used in phishing loaders, malware delivery, and post-exploitation toolkits.
Detects potential Certificate Authority (CA) key theft by correlating command-line execution of certutil (with export flags) on a CA server with subsequent suspicious certificate issuance events. Suspicious issuance includes unauthorized certificate requests (missing event 4886), requests for high-privilege subjects (e.g., Domain Admins), or requests with unusually long validity periods.
Detects the abuse of the Windows built-in utility 'certutil.exe' to download files or decode obfuscated payloads. Attackers frequently use certutil as a Living off the Land Binary (LOLBin) to bypass security controls by leveraging its native capabilities for file transfer (via URL cache) and base64 or hexadecimal decoding.
Detects the abuse of the legitimate Windows utility 'certutil.exe' to download files from external sources or to decode/deobfuscate files on the host, commonly used as a LOLBIN for malicious activities.
This rule detects potentially malicious attempts to import certificates into the Windows certificate store using command-line tools like certutil or direct modification of the registry. This behavior is frequently associated with attackers attempting to establish persistence, bypass certificate validation, or install rogue trust anchors for man-in-the-middle operations.
This rule detects the use of the Windows certutil.exe utility with flags commonly abused by adversaries for file downloads (-urlcache, -urlfetch) or file deobfuscation/decoding (-decode, -decodehex, -encode). It specifically targets LOLBIN (Living Off the Land Binary) behavior by monitoring process command line arguments, while providing allowances for common administrative tasks like PKI maintenance or CRL/OCSP updates to minimize false positives.
This rule detects potentially malicious activity leveraging the Windows Certutil utility for downloading, decoding, and executing files or payloads. It monitors process command line arguments to identify common download flags, hex/base64 decoding operations, evasion techniques, and interaction with high-risk file types or directories. The rule calculates a severity score based on the combination of these behaviors, such as downloading and decoding a file, or executing content from a temporary directory.
This rule detects the use of the Windows utility 'certutil.exe' to download external files, executed from the context of common web server or application processes (e.g., w3wp.exe, nginx.exe). This pattern is a common technique used by attackers to stage malicious payloads or tools in publicly accessible or temporary directories after initial web-based compromise.
This rule detects the use of the Windows utility 'certutil.exe' to download external files, executed from the context of common web server or application processes (e.g., w3wp.exe, nginx.exe). This pattern is a common technique used by attackers to stage malicious payloads or tools in publicly accessible or temporary directories after initial web-based compromise.
Detects a suspicious execution chain where hh.exe (HTML Help) launches wscript.exe, which then executes certutil.exe, followed by the launch of powershell.exe. This pattern is commonly associated with Living-off-the-Land (LotL) techniques to execute malicious scripts or payloads, often used to bypass security controls or fetch remote files.
Detects the execution of Certutil.exe with specific command-line arguments (-decode, -urlcache, -split) or references to suspicious file patterns (Link.dat, Link.ini) which are often indicative of malicious activity such as downloading remote payloads, decoding obfuscated binaries, or staging files for lateral movement.
Detects the execution of known Living-off-the-Land Binaries (LOLBins) such as certutil.exe, msiexec.exe, regsvcs.exe, and regasm.exe when their command line contains suspicious keywords like 'download', 'http', or 'encode'. This activity can indicate an attempt to download malicious payloads or bypass security controls.
Detects the use of the Windows Certutil utility to decode files or extract items from the cache, specifically looking for indicators often associated with file reassembly or extraction of payload components such as Link.dat or Link.ini files.
Detects suspicious certificate installation or modification in the 'Root' or 'TrustedPeople' stores by PowerShell or certutil.exe. This activity is analyzed in the context of common management tools (e.g., winget) or shell environments, which may indicate an attacker attempting to establish persistence or facilitate man-in-the-middle attacks by injecting malicious root certificates.
This rule monitors for potentially malicious use of the Windows Certutil utility, specifically targeting the -urlcache (often used to download remote files) and -decode (used to decode hidden or obfuscated payloads) command-line arguments. It filters out common trusted processes like Microsoft's msiexec.exe to reduce noise.
Detects social engineering lures (like ClickFix, FileFix, and CrashFix) where a user is tricked into manually executing a malicious payload. This rule specifically looks for script interpreters (powershell.exe, cmd.exe, mshta.exe, wscript.exe, cscript.exe) or Living Off The Land Binaries (LOLBins) (rundll32.exe, msiexec.exe, regsvr32.exe, curl.exe, certutil.exe, bitsadmin.exe) being spawned as child processes of web browsers (chrome.exe, msedge.exe, firefox.exe, iexplore.exe, brave.exe, opera.exe) or explorer.exe (indicating execution from a Run dialog). Exclusions are in place for common benign browser update processes.
Detects suspicious payload execution or unexpected child processes spawning directly from the IIS worker process (w3wp.exe), which is a common indicator of web shell activity or exploit payload execution on vulnerable IIS instances.
Detects the execution of PowerShell or pwsh processes launched by wscript or cscript, using hidden window flags and certutil -decode arguments, specifically targeting scripts located in the ProgramData directory. This pattern is frequently observed in malicious file stagers and payload deobfuscation.
This rule monitors for potentially malicious use of the Windows Certutil utility, specifically targeting the -urlcache (often used to download remote files) and -decode (used to decode hidden or obfuscated payloads) command-line arguments. It filters out common trusted processes like Microsoft's msiexec.exe to reduce noise.
Page 1 of 7