Windows certutil.exe Download from Direct IP Using URL/IP-Related Flags
Alerts when certutil.exe is launched with direct-IP download indicators and download-capable certutil flags.
FreeReviewedSigma · High · v2
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-02-15
- Updated
- 2026-07-31
ATT&CK techniques
Defense Evasion → C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags process executions of certutil.exe with command-line content consistent with downloading from direct IP addresses. Attackers often abuse certutil as a living-off-the-land tool to fetch payloads over HTTP/HTTPS while blending into normal Windows activity. It relies on Windows process creation telemetry, specifically the image name and command-line substrings, including URL-related flags and direct IP indicators.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
- forensicitguy.github.iohttps://forensicitguy.github.io/agenttesla-vba-certutil-download/
- news.sophos.comhttps://news.sophos.com/en-us/2021/04/13/compromised-exchange-server-hosting-cryptojacker-targeting-other-exchange-servers/
- twitter.comhttps://twitter.com/egre55/status/1087685529016193025
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/Binaries/Certutil/
- twitter.comhttps://twitter.com/_JohnHammond/status/1708910264261980634
- hexacorn.comhttps://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_certutil_download_direct_ip.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-certutil-exe-download-from-direct-ip-using-urlcache-verifyctl-fl-13e6fe51
title: Windows certutil.exe Download from Direct IP Using URL/IP-Related Flags
id: 046b561d-164b-45c8-ba17-8948d9a5a275
related:
- id: 19b08b1c-861d-4e75-a1ef-ea0c1baf202b
type: similar
- id: 42a5f1e7-9603-4f6d-97ae-3f37d130d794
type: similar
- id: 13e6fe51-d478-4c7e-b0f2-6da9b400a829
type: derived
status: test
description: This rule flags process executions of certutil.exe with command-line content consistent with downloading from direct IP addresses. Attackers often abuse certutil as a living-off-the-land tool to fetch payloads over HTTP/HTTPS while blending into normal Windows activity. It relies on Windows process creation telemetry, specifically the image name and command-line substrings, including URL-related flags and direct IP indicators.
references:
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
- https://forensicitguy.github.io/agenttesla-vba-certutil-download/
- https://news.sophos.com/en-us/2021/04/13/compromised-exchange-server-hosting-cryptojacker-targeting-other-exchange-servers/
- https://twitter.com/egre55/status/1087685529016193025
- https://lolbas-project.github.io/lolbas/Binaries/Certutil/
- https://twitter.com/_JohnHammond/status/1708910264261980634
- https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_certutil_download_direct_ip.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-02-15
modified: 2025-12-01
tags:
- attack.stealth
- attack.t1027
- attack.command-and-control
- attack.t1105
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \certutil.exe
- OriginalFileName: CertUtil.exe
selection_flags:
CommandLine|contains:
- "urlcache "
- "verifyctl "
- "URL "
selection_http:
CommandLine|contains:
- ://1
- ://2
- ://3
- ://4
- ://5
- ://6
- ://7
- ://8
- ://9
filter_main_seven_zip:
CommandLine|contains: ://7-
condition: all of selection_* and not 1 of filter_main_*
falsepositives:
- Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_download_direct_ip/info.yml
license: DRL-1.1