Windows: certutil.exe File Encoding to Base64 Using the -encode Flag

Alerts on Windows certutil.exe executions using -encode to base64-encode a file.

FreeReviewedSigma · Medium · v2

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2019-02-24
Updated: 2026-07-31

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1027Obfuscated Files or Information
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process executions of certutil.exe where the command line includes the -encode flag. Encoding file content with built-in Windows tools can be used to transform data for staging or exfiltration, blending into normal administrative activity. It relies on Windows process creation telemetry capturing the executed image name and command-line arguments.

Reporting behind it

Related detections9 linkedT1027 — drag to rearrange

Malicious FIN7 Powertrash Loader Execution via Obfuscated PowerShell (via process_creation)

Suspicious XOR Obfuscated PowerShell from ClickFix Distribution

Suspicious PowerShell Executing Code from Environment Variable (via process_creation)

Suspicious Payload Staging in ProgramData IntelDriver Folder (via file_event)

Suspicious In-Memory Runspace Execution via PowerShell Script Block

Suspicious Python Inline Deobfuscation and Execution One-Liner

Suspicious PowerShell Reflective Assembly Load With Registry Property Read via Script Block (via ps_script)

Suspicious Archive Extraction From AppData Staging Folder via Process Creation

Suspicious Encoded PowerShell Using Base64 Stream Decompression Routines (via process_creation)

Windows: certutil.exe File Encoding to Base64 Using the -encode Flag

Pivot detection · T1027 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-certutil-exe-file-encode-to-base64-via-encode-flag-e62a9f0c

title: "Windows: certutil.exe File Encoding to Base64 Using the -encode Flag"
id: 4c42801e-61b9-4eab-a262-4db10b484748
status: test
description: This rule flags process executions of certutil.exe where the command line includes the -encode flag. Encoding file content with built-in Windows tools can be used to transform data for staging or exfiltration, blending into normal administrative activity. It relies on Windows process creation telemetry capturing the executed image name and command-line arguments.
references:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
  - https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/
  - https://lolbas-project.github.io/lolbas/Binaries/Certutil/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_certutil_encode.yml
author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2019-02-24
modified: 2024-03-05
tags:
  - attack.stealth
  - attack.t1027
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \certutil.exe
    - OriginalFileName: CertUtil.exe
  selection_cli:
    CommandLine|contains|windash: -encode
  condition: all of selection_*
falsepositives:
  - As this is a general purpose rule, legitimate usage of the encode functionality will trigger some false positives. Apply additional filters accordingly
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_encode/info.yml
license: DRL-1.1
related:
  - id: e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL