huntrule

Windows: certutil.EXE Downloading Files from File-Sharing Domains via Suspicious Flags

Alert when certutil.exe is run with URL/download flags targeting common file-sharing domains.

FreeReviewedSigma · High · v2
Product
windows
Category
process_creation
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-02-15
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Defense Evasion → C2

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags execution of certutil.exe with command-line flags consistent with downloading remote content and includes those actions targeting common file-sharing or paste-hosting domains. Attackers can use certutil.exe as a living-off-the-land utility to retrieve payloads or additional tools without using more overt downloaders. The detection relies on Windows process creation telemetry, matching certutil.exe execution, suspicious command-line substrings, and the presence of file-sharing domain strings in the command line.

Reporting behind it

Related detections9 linkedT1105 — drag to rearrange
Suspicious PowerShell Download Of Text-Disguised Payload
Windows certutil.exe Download from Direct IP Using URL/IP-Related Flags
Windows certutil.exe Used to Download Files via Suspicious Command-Line Flags
Windows Security: Password-Protected ZIP Opened with Suspicious Filename Indicators
Suspicious Shell Command Obfuscation via printf Escape Encoding on VMware ESXi (via process_creation)
Suspicious Remote Script Transfer via Bitsadmin (via process_creation)
Suspicious PowerShell Download Cradle via ClickFix Fake CAPTCHA (via process_creation)
Malicious Curl MSI Download to ProgramData via Process Creation
Suspicious CloudZ RAT Payload Download via curl to ProgramData
Windows: certutil.EXE Downloading Files from File-Sharing Domains via Suspicious Flags
Pivot detection · T1105 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.