Windows certutil.exe Download Execution with URL Cache/Verify Flags

Alerts on certutil.exe runs with URL/HTTP-related flags indicative of remote file download.

FreeUnreviewedSigmamediumv1

windows-certutil-exe-download-execution-with-url-cache-verify-flags-19b08b1c

title: Windows certutil.exe Download Execution with URL Cache/Verify Flags
id: 406f276a-42ca-4709-bbdc-f0b4cd17ff04
related:
  - id: 13e6fe51-d478-4c7e-b0f2-6da9b400a829
    type: similar
  - id: 19b08b1c-861d-4e75-a1ef-ea0c1baf202b
    type: derived
status: test
description: This rule flags Windows process creation events where certutil.exe is executed with command-line flags commonly used to fetch or handle remote content via URL-related options. Attackers often use certutil.exe as a living-off-the-land tool to download payloads while blending into legitimate administrative activity. The detection relies on process creation telemetry, matching the certutil executable via Image or OriginalFileName and combining command-line substring indicators for URL cache/verify behavior plus the presence of 'http'.
references:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
  - https://forensicitguy.github.io/agenttesla-vba-certutil-download/
  - https://news.sophos.com/en-us/2021/04/13/compromised-exchange-server-hosting-cryptojacker-targeting-other-exchange-servers/
  - https://twitter.com/egre55/status/1087685529016193025
  - https://lolbas-project.github.io/lolbas/Binaries/Certutil/
  - https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_certutil_download.yml
author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-02-15
modified: 2025-12-01
tags:
  - attack.stealth
  - attack.t1027
  - attack.command-and-control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \certutil.exe
    - OriginalFileName: CertUtil.exe
  selection_flags:
    CommandLine|contains:
      - "urlcache "
      - "verifyctl "
      - "URL "
  selection_http:
    CommandLine|contains: http
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_download/info.yml
license: DRL-1.1

What it detects

This rule flags Windows process creation events where certutil.exe is executed with command-line flags commonly used to fetch or handle remote content via URL-related options. Attackers often use certutil.exe as a living-off-the-land tool to download payloads while blending into legitimate administrative activity. The detection relies on process creation telemetry, matching the certutil executable via Image or OriginalFileName and combining command-line substring indicators for URL cache/verify behavior plus the presence of 'http'.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.