Windows certutil.exe Download from Direct IP Using URL/IP-Related Flags

ATT&CK techniques

Defense Evasion → C2

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1027Obfuscated Files or Information
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1105Ingress Tool Transfer
Exfiltration
Impact

What it detects

This rule flags process executions of certutil.exe with command-line content consistent with downloading from direct IP addresses. Attackers often abuse certutil as a living-off-the-land tool to fetch payloads over HTTP/HTTPS while blending into normal Windows activity. It relies on Windows process creation telemetry, specifically the image name and command-line substrings, including URL-related flags and direct IP indicators.

Reporting behind it

Related detections9 linkedT1105 — drag to rearrange

Suspicious PowerShell Download Of Text-Disguised Payload

Windows certutil.exe Used to Download Files via Suspicious Command-Line Flags

Windows: certutil.EXE Downloading Files from File-Sharing Domains via Suspicious Flags

Windows Security: Password-Protected ZIP Opened with Suspicious Filename Indicators

Suspicious Shell Command Obfuscation via printf Escape Encoding on VMware ESXi (via process_creation)

Suspicious Remote Script Transfer via Bitsadmin (via process_creation)

Suspicious PowerShell Download Cradle via ClickFix Fake CAPTCHA (via process_creation)

Malicious Curl MSI Download to ProgramData via Process Creation

Suspicious CloudZ RAT Payload Download via curl to ProgramData

Windows certutil.exe Download from Direct IP Using URL/IP-Related Flags

Pivot detection · T1105 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-certutil-exe-download-from-direct-ip-using-urlcache-verifyctl-fl-13e6fe51

title: Windows certutil.exe Download from Direct IP Using URL/IP-Related Flags
id: 046b561d-164b-45c8-ba17-8948d9a5a275
related:
  - id: 19b08b1c-861d-4e75-a1ef-ea0c1baf202b
    type: similar
  - id: 42a5f1e7-9603-4f6d-97ae-3f37d130d794
    type: similar
  - id: 13e6fe51-d478-4c7e-b0f2-6da9b400a829
    type: derived
status: test
description: This rule flags process executions of certutil.exe with command-line content consistent with downloading from direct IP addresses. Attackers often abuse certutil as a living-off-the-land tool to fetch payloads over HTTP/HTTPS while blending into normal Windows activity. It relies on Windows process creation telemetry, specifically the image name and command-line substrings, including URL-related flags and direct IP indicators.
references:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
  - https://forensicitguy.github.io/agenttesla-vba-certutil-download/
  - https://news.sophos.com/en-us/2021/04/13/compromised-exchange-server-hosting-cryptojacker-targeting-other-exchange-servers/
  - https://twitter.com/egre55/status/1087685529016193025
  - https://lolbas-project.github.io/lolbas/Binaries/Certutil/
  - https://twitter.com/_JohnHammond/status/1708910264261980634
  - https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_certutil_download_direct_ip.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-02-15
modified: 2025-12-01
tags:
  - attack.stealth
  - attack.t1027
  - attack.command-and-control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \certutil.exe
    - OriginalFileName: CertUtil.exe
  selection_flags:
    CommandLine|contains:
      - "urlcache "
      - "verifyctl "
      - "URL "
  selection_http:
    CommandLine|contains:
      - ://1
      - ://2
      - ://3
      - ://4
      - ://5
      - ://6
      - ://7
      - ://8
      - ://9
  filter_main_seven_zip:
    CommandLine|contains: ://7-
  condition: all of selection_* and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_download_direct_ip/info.yml
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL