Windows: certutil.exe -encode Base64 of Suspicious Extensions

Alert on certutil.exe -encode activity that targets files with suspicious extensions.

FreeUnreviewedSigmahighv1

windows-certutil-exe-encode-base64-of-suspicious-extensions-ea0cdc3e

title: "Windows: certutil.exe -encode Base64 of Suspicious Extensions"
id: 1d195dd8-1ead-4b5f-a963-3787ce57a4ad
related:
  - id: e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a
    type: derived
  - id: ea0cdc3e-2239-4f26-a947-4e8f8224e464
    type: derived
status: test
description: This rule flags Windows process executions where certutil.exe is run with the -encode flag to convert a file to Base64. It further narrows matches by requiring the command line to reference a suspicious file extension (e.g., scripts, office docs, images, PDFs, archives-like temp files). Attackers may use this to obfuscate or prepare data for stealthy transfer or later execution. The detection relies on Windows process creation telemetry capturing the executable path/name and full command line content.
references:
  - https://www.virustotal.com/gui/file/35c22725a92d5cb1016b09421c0a6cdbfd860fd4778b3313669b057d4a131cb7/behavior
  - https://www.virustotal.com/gui/file/427616528b7dbc4a6057ac89eb174a3a90f7abcf3f34e5a359b7a910d82f7a72/behavior
  - https://www.virustotal.com/gui/file/34de4c8beded481a4084a1fd77855c3e977e8ac643e5c5842d0f15f7f9b9086f/behavior
  - https://www.virustotal.com/gui/file/4abe1395a09fda06d897a9c4eb247278c1b6cddda5d126ce5b3f4f499e3b8fa2/behavior
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_certutil_encode_susp_extensions.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-15
modified: 2024-03-05
tags:
  - attack.stealth
  - attack.t1027
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \certutil.exe
    - OriginalFileName: CertUtil.exe
  selection_cli:
    CommandLine|contains|windash: -encode
  selection_extension:
    CommandLine|contains:
      - .acl
      - .bat
      - .doc
      - .gif
      - .jpeg
      - .jpg
      - .mp3
      - .pdf
      - .png
      - .ppt
      - .tmp
      - .xls
      - .xml
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_encode_susp_extensions/info.yml
license: DRL-1.1

What it detects

This rule flags Windows process executions where certutil.exe is run with the -encode flag to convert a file to Base64. It further narrows matches by requiring the command line to reference a suspicious file extension (e.g., scripts, office docs, images, PDFs, archives-like temp files). Attackers may use this to obfuscate or prepare data for stealthy transfer or later execution. The detection relies on Windows process creation telemetry capturing the executable path/name and full command line content.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.