Sigma detection rules, expert-reviewed

Windows: certutil.EXE Downloading Files from File-Sharing Domains via Suspicious Flags

Alert when certutil.exe is run with URL/download flags targeting common file-sharing domains.

Windows certutil.exe Download from Direct IP Using URL/IP-Related Flags

Alerts when certutil.exe is launched with direct-IP download indicators and download-capable certutil flags.

Windows certutil.exe Used to Download Files via Suspicious Command-Line Flags

Alerts on certutil.exe runs with URL/HTTP-related flags indicative of remote file download.

Windows certutil.exe Base64/Hex Decode via -decode or -decodehex Flags

Flags certutil.exe use for decoding base64 or hex data via -decode or -decodehex on Windows.

Windows: Suspicious child processes spawned by ManageEngine ServiceDesk Plus (java.exe parent)

Alerts when ManageEngine ServiceDesk Java spawns common attacker tools like PowerShell, certutil, mshta, or wmic.

Windows certutil.exe Initiates Network Connections to Common Service Ports

Alerts when certutil.exe initiates outbound network connections to ports 80, 135, 443, or 445 on Windows.

Suspicious Child Process Spawning by PowerShell on Windows

Alerts when PowerShell spawns potentially suspicious child binaries (e.g., certutil, mshta, wmic, rundll32), with exclusions for known benign patterns.

Windows LOLBIN Execution From Abnormal Drive (calc, certutil, mshta, regsvr32, rundll32)

Flags Windows LOLBIN execution when process CurrentDirectory is not empty/null and contains C:\, indicating unusual launch context.

Windows Process Creation: Suspicious Children Spawned by HTML Help (hh.exe)

Flags HH.exe spawning CertReq/CertUtil/CMD/PowerShell/cscript/regsvr32/mshta and other common Windows execution utilities.

Windows: certutil.exe File Encoding to Base64 Using the -encode Flag

Alerts on Windows certutil.exe executions using -encode to base64-encode a file.