Windows: certutil.exe File Encoding to Base64 Using the -encode Flag

Alerts on Windows certutil.exe executions using -encode to base64-encode a file.

FreeReviewedSigma · Medium · v2

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2019-02-24
Updated: 2026-07-31

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1027Obfuscated Files or Information
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process executions of certutil.exe where the command line includes the -encode flag. Encoding file content with built-in Windows tools can be used to transform data for staging or exfiltration, blending into normal administrative activity. It relies on Windows process creation telemetry capturing the executed image name and command-line arguments.

Reporting behind it

Related detections9 linkedT1027 — drag to rearrange

Suspicious PowerShell Invoke-Expression with Replace Obfuscation

Suspicious Base64 Decoded Payload Piped to Shell

Suspicious Shell Command Obfuscation via printf Escape Encoding on VMware ESXi (via process_creation)

Malicious Emmenhtal JavaScript Loader Spawning Encoded PowerShell

Suspicious Python Interpreter Launching Encoded PowerShell via subprocess

Suspicious PowerShell Download Of Text-Disguised Payload

Suspicious Encrypted Implant File Creation for DLL Search Order Hijacking (RainyDay Turian PlugX)

Suspicious PS1Bot PowerShell Payload Written to ProgramData (via file_event)

Malicious Non-Interactive Encoded PowerShell Stager (via process_creation)

Windows: certutil.exe File Encoding to Base64 Using the -encode Flag

Pivot detection · T1027 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-certutil-exe-file-encode-to-base64-via-encode-flag-e62a9f0c

title: "Windows: certutil.exe File Encoding to Base64 Using the -encode Flag"
id: 4c42801e-61b9-4eab-a262-4db10b484748
status: test
description: This rule flags process executions of certutil.exe where the command line includes the -encode flag. Encoding file content with built-in Windows tools can be used to transform data for staging or exfiltration, blending into normal administrative activity. It relies on Windows process creation telemetry capturing the executed image name and command-line arguments.
references:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
  - https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/
  - https://lolbas-project.github.io/lolbas/Binaries/Certutil/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_certutil_encode.yml
author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2019-02-24
modified: 2024-03-05
tags:
  - attack.stealth
  - attack.t1027
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \certutil.exe
    - OriginalFileName: CertUtil.exe
  selection_cli:
    CommandLine|contains|windash: -encode
  condition: all of selection_*
falsepositives:
  - As this is a general purpose rule, legitimate usage of the encode functionality will trigger some false positives. Apply additional filters accordingly
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_encode/info.yml
license: DRL-1.1
related:
  - id: e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL