Sigma detection rules, expert-reviewed

Suspicious Certutil UrlCache Download of Remote CAB Payload (via process_creation)

This rule detects certutil.exe using the urlcache and split options to download a remote CAB file into ProgramData as used by the Larva-26010 SoftEther VPN intrusion to stage tooling. This certutil pattern is a well known living off the land download technique.

Malicious Certutil Decode of Encoded Web Shell to ASPX (via process_creation)

This rule detects certutil.exe decoding a text file into an ASPX web shell within a web server images directory as seen in the targeted MS-SQL server intrusion. Certutil decoding output directly into a web accessible aspx file is a common web shell deployment technique.

Obfuscated File Decoding via Certutil (via process_creation)

This rule detects certutil being used with its decode flags to convert a base64 or hex-encoded file back into an executable payload, a deobfuscation step adversaries use to reconstruct malware from a benign-looking encoded file. Certutil deobfuscation is a defense-evasion technique in the Red Canary Threat Detection Report because it hides payloads from content inspection in transit. Detecting decode invocations surfaces payload staging under a trusted binary.

Obfuscated Certutil Payload Obfuscation - Command (via process_creation)

This rule detects abuse certutil command to download obfuscated malicious payload. Tools like Tchopper can trigger this rule.

Obfuscated Certutil Payload Download - Command (via process_creation)

This rule detects abuse certutil command to download obfuscated malicious payload.

Suspicious Certutil URLCache Remote Payload Download via process_creation

This rule detects certutil.exe invoked with the urlcache and split flags which downloads a remote file to disk while masquerading as certificate maintenance. Attackers in the SOC web shell case used obfuscated certutil to fetch a 404.aspx web shell onto the server. This living-off-the-land download technique bypasses many application allow lists and is worth alerting on.

Suspicious Base64 Decoding via Certutil

This rule detects certutil used with its decode flag to deobfuscate Base64-encoded content on disk. The KimJongRAT variant chains certutil and findstr to decode staged payloads before execution. Certutil-based decoding is a living-off-the-land deobfuscation technique that bypasses many controls.

Malicious APT29 Certutil Decode of Disguised Text File to Archive (via process_creation)

This rule detects certutil decoding a .txt file into a .zip archive, the staging step APT29 used to reconstruct a WINELOADER payload from a disguised invite. Delivering the archive as Base64 text and decoding it locally with certutil evades transfer-time inspection. Certutil decoding text into an archive is a deobfuscation behavior tied to this intrusion set.

Suspicious PXA Stealer Payload Decoding via certutil (via process_creation)

This rule detects the use of certutil to decode a disguised document into an archive during PXA Stealer infections. The actors named the decoded output with a pdf extension while it actually contained a password-protected archive for later extraction. Living-off-the-land decoding of pdf-named blobs is uncommon in benign use.

Suspicious Certutil Encode or Decode for Payload Obfuscation (via process_creation)

This rule detects certutil being used with the -encode or -decode options to transform files between binary and Base64 form. Threat actors exploiting Citrix NetScaler CVE-2023-4966 used certutil to stage and deobfuscate tooling while evading content inspection. This living-off-the-land use of certutil for data encoding is a common defense-evasion and deobfuscation behavior.

Suspicious File Download via Certutil URLCache

This rule detects certutil abused as a downloader through its urlcache and file flags to retrieve a remote payload over HTTP. This LOLBin technique was documented delivering executables into the temp directory before execution. Living-off-the-land downloads via certutil let attackers stage tooling while evading application controls.

Malicious Payload Download and Execution via certutil urlcache (via process_creation)

This rule detects certutil being used with the urlcache option to download a remote executable to disk, a living off the land technique used by a ransomware actor after exploiting an unsupported ColdFusion server to fetch and launch beacon payloads into the Windows temp directory. Legitimate use of certutil to download arbitrary executables over HTTP is rare.

Suspicious TALONITE Certutil LOLBIN Decode and Download Abuse (via process_creation)

This rule detects certutil.exe invoked with decode, URL cache, or verifyctl arguments used to deobfuscate or download payloads. TALONITE abuses certutil as a living-off-the-land binary to decode staged content and retrieve additional tooling during intrusions. Certutil used for file decoding or remote fetch outside certificate management is a common defense-evasion and delivery technique.

Suspicious File Download via Certutil URLCache

This rule detects certutil being used with its url cache download flags which the ALPHV intrusion leveraged as a living off the land downloader to stage tooling and this matters because certutil is a signed system binary frequently abused to retrieve remote payloads and its download flags rarely appear in legitimate certificate operations.

Suspicious File Download via certutil urlcache split

This rule detects certutil downloading a file using the urlcache split -f flag combination, an ingress technique used in the ActiveMQ intrusion. Legitimate certutil usage does not combine these download flags, so this pattern reliably flags living-off-the-land payload retrieval.