Windows Process Creation: certutil.exe -encode writing Base64 from Suspicious Directories

Alert on certutil.exe running with -encode when the command line references files under suspicious directories.

FreeUnreviewedSigmahighv1

windows-process-creation-certutil-exe-encode-writing-base64-from-suspicious-dire-82a6714f

title: "Windows Process Creation: certutil.exe -encode writing Base64 from Suspicious Directories"
id: 9d7f3ecb-075d-4b48-aab8-72fb9c8dbff5
related:
  - id: e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a
    type: derived
  - id: 82a6714f-4899-4f16-9c1e-9a333544d4c3
    type: derived
status: test
description: This rule flags execution of certutil.exe using the -encode flag while the target file path appears to be in potentially suspicious user or system directories. Attackers commonly use certutil to transform or stage data (for example, encoding content for transfer or concealment) and choosing unusual locations can indicate stealthy preparation. Telemetry relies on Windows process creation fields for the executable name and command line, including the presence of -encode and matching directory substrings in the command line.
references:
  - https://www.virustotal.com/gui/file/35c22725a92d5cb1016b09421c0a6cdbfd860fd4778b3313669b057d4a131cb7/behavior
  - https://www.virustotal.com/gui/file/427616528b7dbc4a6057ac89eb174a3a90f7abcf3f34e5a359b7a910d82f7a72/behavior
  - https://www.virustotal.com/gui/file/34de4c8beded481a4084a1fd77855c3e977e8ac643e5c5842d0f15f7f9b9086f/behavior
  - https://www.virustotal.com/gui/file/4abe1395a09fda06d897a9c4eb247278c1b6cddda5d126ce5b3f4f499e3b8fa2/behavior
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_certutil_encode_susp_location.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-15
modified: 2024-03-05
tags:
  - attack.stealth
  - attack.t1027
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \certutil.exe
    - OriginalFileName: CertUtil.exe
  selection_cli:
    CommandLine|contains|windash: -encode
  selection_extension:
    CommandLine|contains:
      - \AppData\Roaming\
      - \Desktop\
      - \Local\Temp\
      - \PerfLogs\
      - \Users\Public\
      - \Windows\Temp\
      - $Recycle.Bin
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_encode_susp_location/info.yml
license: DRL-1.1

What it detects

This rule flags execution of certutil.exe using the -encode flag while the target file path appears to be in potentially suspicious user or system directories. Attackers commonly use certutil to transform or stage data (for example, encoding content for transfer or concealment) and choosing unusual locations can indicate stealthy preparation. Telemetry relies on Windows process creation fields for the executable name and command line, including the presence of -encode and matching directory substrings in the command line.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.