Windows certutil.exe Base64/Hex Decoding via -decode or -decodehex

title: Windows certutil.exe Base64/Hex Decoding via -decode or -decodehex
id: c1c63709-20fb-482d-9471-8ea6b3b0f2cd
status: test
description: This rule identifies execution of certutil.exe when it is used with the -decode or -decodehex flags to decode base64 or hex-encoded data. Attackers can use this to transform an encoded payload into a usable form during an intrusion. It relies on Windows process creation telemetry, matching certutil.exe and the presence of the decode-related command-line arguments.
references:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
  - https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/
  - https://news.sophos.com/en-us/2021/04/13/compromised-exchange-server-hosting-cryptojacker-targeting-other-exchange-servers/
  - https://twitter.com/JohnLaTwC/status/835149808817991680
  - https://learn.microsoft.com/en-us/archive/blogs/pki/basic-crl-checking-with-certutil
  - https://lolbas-project.github.io/lolbas/Binaries/Certutil/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_certutil_decode.yml
author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Huntrule Team
date: 2023-02-15
modified: 2025-06-04
tags:
  - attack.stealth
  - attack.t1027
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \certutil.exe
    - OriginalFileName: CertUtil.exe
  selection_cli:
    CommandLine|contains|windash:
      - "-decode "
      - "-decodehex "
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_decode/info.yml
license: DRL-1.1
related:
  - id: cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7
    type: derived