Windows: certutil.exe File Encode to Base64 via -encode Flag

Alerts on Windows certutil.exe executions using -encode to base64-encode a file.

FreeUnreviewedSigmamediumv1

windows-certutil-exe-file-encode-to-base64-via-encode-flag-e62a9f0c

title: "Windows: certutil.exe File Encode to Base64 via -encode Flag"
id: 4c42801e-61b9-4eab-a262-4db10b484748
status: test
description: This rule flags process executions where certutil.exe is run with the -encode option, indicating a file is being converted for output (commonly to Base64). Attackers abuse this capability to stage or exfiltrate data in an encoded form while relying on a trusted system utility. It relies on Windows process creation telemetry, matching the certutil executable and the presence of the -encode flag in the command line.
references:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
  - https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/
  - https://lolbas-project.github.io/lolbas/Binaries/Certutil/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_certutil_encode.yml
author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2019-02-24
modified: 2024-03-05
tags:
  - attack.stealth
  - attack.t1027
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \certutil.exe
    - OriginalFileName: CertUtil.exe
  selection_cli:
    CommandLine|contains|windash: -encode
  condition: all of selection_*
falsepositives:
  - As this is a general purpose rule, legitimate usage of the encode functionality will trigger some false positives. Apply additional filters accordingly
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_encode/info.yml
license: DRL-1.1
related:
  - id: e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a
    type: derived

What it detects

This rule flags process executions where certutil.exe is run with the -encode option, indicating a file is being converted for output (commonly to Base64). Attackers abuse this capability to stage or exfiltrate data in an encoded form while relying on a trusted system utility. It relies on Windows process creation telemetry, matching the certutil executable and the presence of the -encode flag in the command line.

Known false positives

As this is a general purpose rule, legitimate usage of the encode functionality will trigger some false positives. Apply additional filters accordingly

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.