Sigma detection rules, expert-reviewed

Suspicious File Download via Certutil URLCache

This rule detects certutil being used with its url cache download flags which the ALPHV intrusion leveraged as a living off the land downloader to stage tooling and this matters because certutil is a signed system binary frequently abused to retrieve remote payloads and its download flags rarely appear in legitimate certificate operations.

Suspicious File Download via certutil urlcache split

This rule detects certutil downloading a file using the urlcache split -f flag combination, an ingress technique used in the ActiveMQ intrusion. Legitimate certutil usage does not combine these download flags, so this pattern reliably flags living-off-the-land payload retrieval.

Suspicious File Download via certutil urlcache

This rule detects certutil used with the urlcache and split flags to download a remote file, an ingress tool transfer technique observed in the REF7707 espionage campaign. Adversaries abuse the signed certutil utility to retrieve payloads while blending in with trusted Windows binaries. This flag combination has no routine administrative use and reliably indicates tooling download.

Masquerading Blank Grabber Payload Decoding via Certutil Decode Flag (via process_creation)

This rule detects certutil being run with its decode flag to convert a base64-encoded file back into an executable payload, the deobfuscation step Blank Grabber uses to reconstruct its loader while masquerading the data as a certificate. Adversaries leverage certutil as a trusted LOLBin to decode staged payloads and evade content controls, making early detection critical for catching the loader before execution.

Suspicious File Download via certutil

This rule detects certutil.exe being used with URL-cache download arguments to retrieve remote files, a living-off-the-land technique used by RansomHub affiliates to stage tooling. certutil is not a general purpose downloader, so its use to fetch remote content commonly indicates ingress tool transfer by an adversary.

Suspicious Certutil URL Download to Public Directory (Soco404 Cryptomining)

This rule detects certutil used with its urlcache flag to fetch a remote payload, the download technique of the Soco404 campaign that staged binaries under the Public user directory. It matters because certutil acting as a downloader is a living off the land pattern used to pull cryptomining payloads onto Windows hosts.

Suspicious Certutil URLCache Download

This rule detects certutil.exe used with the urlcache option to download a remote file. The DragonRank SEO-poisoning operators abused certutil urlcache to pull additional tooling onto compromised IIS servers. Certutil functioning as a downloader is a living-off-the-land ingress technique that evades controls expecting a browser or dedicated transfer tool.

Malicious Payload Decoding via Certutil

This rule detects certutil using its decode function against PDF-named files to reconstruct an executable payload from base64, a defense-evasion and deobfuscation step. This was observed in a Vietnamese threat actor chain delivering PureRAT. Abusing certutil to decode disguised files bypasses download controls and unpacks the next-stage loader.

Suspicious File Download via Certutil URLCache [Huntress] #2

This rule detects certutil.exe downloading a remote file using the urlcache option, a LOLBIN download technique Huntress observed after Wing FTP CVE-2025-47812 exploitation. Attackers use certutil to retrieve payloads over HTTP while blending in with a trusted signed binary. Certutil retrieving content from a URL is a common ingress tool transfer indicator that warrants review of the fetched resource.

Malicious LOLBin Download Saved as Windows Utility ping.exe via certutil or curl

This rule detects use of certutil or curl to download a remote file and save it under the name of a legitimate Windows utility such as ping.exe. The Mysterious Elephant APT used this masquerading technique to stage payloads disguised as trusted system binaries. Writing downloaded content to a well-known utility name in a non-System32 location is a strong indicator of ingress tool transfer combined with defense evasion.

Suspicious Child Process Spawned by Diskshadow.exe (Windows Process Creation)

Alerts on process creation where Diskshadow.exe spawns certutil, cscript, mshta, PowerShell, regsvr32, rundll32, or wscript.

Windows Process Creation: certutil.exe Encodes Files to Base64 in Suspicious Paths

Alert on certutil.exe running with -encode when the command line references files under suspicious directories.

Windows: certutil.exe Encodes Files to Base64 Using -encode With Suspicious Extensions

Alert on certutil.exe -encode activity that targets files with suspicious extensions.

Windows: Root Certificate Added Using certutil.exe -addstore

Flags certutil.exe executions that use -addstore with root-related parameters to install a certificate.

Windows: certutil.exe ExportPFX certificate export via -exportPFX flag

Flags certutil.exe executions on Windows that include the -exportPFX argument to export certificate material.