Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

File Decoded From Base64/Hex Via Certutil.EXE

Detects the execution of certutil with either the "decode" or "decodehex" flags to decode base64 or hex encoded files. This can be abused by attackers to decode an encoded payload before execution

ATT&CK coverage

Outside the enterprise matrix

T1027

Detection requirements

Log source product: windows
Log source category: process_creation

What the source says

What fires this without an attack behind it

Unknown

References

https://learn.microsoft.com/en-us/archive/blogs/pki/basic-crl-checking-with-certutil
https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
https://lolbas-project.github.io/lolbas/Binaries/Certutil/
https://news.sophos.com/en-us/2021/04/13/compromised-exchange-server-hosting-cryptojacker-targeting-other-exchange-servers/
https://twitter.com/JohnLaTwC/status/835149808817991680
https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/

Tagged by the source as

attack.stealth

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.