Windows certutil.exe Base64/Hex Decode via -decode or -decodehex Flags

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1027Obfuscated Files or Information
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies execution of certutil.exe when invoked with either the -decode or -decodehex flags, indicating decoding of base64 or hex-encoded content. Attackers can use this to reconstruct an encoded payload or configuration before subsequent execution. It relies on Windows process creation telemetry, matching the certutil binary and specific command-line arguments.

Reporting behind it

Related detections9 linkedT1027 — drag to rearrange

Suspicious Shell Command Obfuscation via printf Escape Encoding on VMware ESXi (via process_creation)

Malicious Emmenhtal JavaScript Loader Spawning Encoded PowerShell

Suspicious Python Interpreter Launching Encoded PowerShell via subprocess

Suspicious PowerShell Download Of Text-Disguised Payload

Suspicious Encrypted Implant File Creation for DLL Search Order Hijacking (RainyDay Turian PlugX)

Suspicious PS1Bot PowerShell Payload Written to ProgramData (via file_event)

Malicious Non-Interactive Encoded PowerShell Stager (via process_creation)

Suspicious Hidden PowerShell Executing Substring of Dropped File

PowerShell Encoded or Download-Cradle Command Line (via process_creation)

Windows certutil.exe Base64/Hex Decode via -decode or -decodehex Flags

Pivot detection · T1027 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-certutil-exe-base64-hex-decoding-via-decode-or-decodehex-cc9cbe82

title: Windows certutil.exe Base64/Hex Decode via -decode or -decodehex Flags
id: c1c63709-20fb-482d-9471-8ea6b3b0f2cd
status: test
description: This rule identifies execution of certutil.exe when invoked with either the -decode or -decodehex flags, indicating decoding of base64 or hex-encoded content. Attackers can use this to reconstruct an encoded payload or configuration before subsequent execution. It relies on Windows process creation telemetry, matching the certutil binary and specific command-line arguments.
references:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
  - https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/
  - https://news.sophos.com/en-us/2021/04/13/compromised-exchange-server-hosting-cryptojacker-targeting-other-exchange-servers/
  - https://twitter.com/JohnLaTwC/status/835149808817991680
  - https://learn.microsoft.com/en-us/archive/blogs/pki/basic-crl-checking-with-certutil
  - https://lolbas-project.github.io/lolbas/Binaries/Certutil/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_certutil_decode.yml
author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Huntrule Team
date: 2023-02-15
modified: 2025-06-04
tags:
  - attack.stealth
  - attack.t1027
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \certutil.exe
    - OriginalFileName: CertUtil.exe
  selection_cli:
    CommandLine|contains|windash:
      - "-decode "
      - "-decodehex "
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_decode/info.yml
license: DRL-1.1
related:
  - id: cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL