Windows certutil.exe Initiating Network Connections to Common Service Ports

title: Windows certutil.exe Initiating Network Connections to Common Service Ports
id: 95205cda-0700-42f3-9754-395e2cba38d4
status: test
description: This rule flags network connections where certutil.exe initiates outbound traffic to ports associated with common services (80, 135, 443, 445). Attackers may misuse certutil.exe to fetch remote content and stage additional payloads, making this behavior a useful indicator of suspicious command-and-control activity. The detection relies on network connection telemetry that includes the initiating process path and destination port.
references:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_certutil_initiated_connection.yml
author: frack113, Florian Roth (Nextron Systems), Huntrule Team
date: 2022-09-02
modified: 2024-05-31
tags:
  - attack.command-and-control
  - attack.t1105
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: \certutil.exe
    Initiated: "true"
    DestinationPort:
      - 80
      - 135
      - 443
      - 445
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 0dba975d-a193-4ed1-a067-424df57570d1
    type: derived