Every published rule

Suspicious Child Process Spawned by Diskshadow.exe (Windows Process Creation)

Alerts on process creation where Diskshadow.exe spawns certutil, cscript, mshta, PowerShell, regsvr32, rundll32, or wscript.

Windows Process Creation: certutil.exe Encodes Files to Base64 in Suspicious Paths

Alert on certutil.exe running with -encode when the command line references files under suspicious directories.

Windows: certutil.exe Encodes Files to Base64 Using -encode With Suspicious Extensions

Alert on certutil.exe -encode activity that targets files with suspicious extensions.

Windows: Root Certificate Added Using certutil.exe -addstore

Flags certutil.exe executions that use -addstore with root-related parameters to install a certificate.

Windows: certutil.exe ExportPFX certificate export via -exportPFX flag

Flags certutil.exe executions on Windows that include the -exportPFX argument to export certificate material.

Windows: certutil.EXE Downloading Files from File-Sharing Domains via Suspicious Flags

Alert when certutil.exe is run with URL/download flags targeting common file-sharing domains.

Windows certutil.exe Download from Direct IP Using URL/IP-Related Flags

Alerts when certutil.exe is launched with direct-IP download indicators and download-capable certutil flags.

Windows certutil.exe Used to Download Files via Suspicious Command-Line Flags

Alerts on certutil.exe runs with URL/HTTP-related flags indicative of remote file download.

Windows certutil.exe Base64/Hex Decode via -decode or -decodehex Flags

Flags certutil.exe use for decoding base64 or hex data via -decode or -decodehex on Windows.

Windows: Suspicious child processes spawned by ManageEngine ServiceDesk Plus (java.exe parent)

Alerts when ManageEngine ServiceDesk Java spawns common attacker tools like PowerShell, certutil, mshta, or wmic.

Windows certutil.exe Initiates Network Connections to Common Service Ports

Alerts when certutil.exe initiates outbound network connections to ports 80, 135, 443, or 445 on Windows.

Suspicious Child Process Spawning by PowerShell on Windows

Alerts when PowerShell spawns potentially suspicious child binaries (e.g., certutil, mshta, wmic, rundll32), with exclusions for known benign patterns.

Windows LOLBIN Execution From Abnormal Drive (calc, certutil, mshta, regsvr32, rundll32)

Flags Windows LOLBIN execution when process CurrentDirectory is not empty/null and contains C:\, indicating unusual launch context.

Windows Process Creation: Suspicious Children Spawned by HTML Help (hh.exe)

Flags HH.exe spawning CertReq/CertUtil/CMD/PowerShell/cscript/regsvr32/mshta and other common Windows execution utilities.

Windows: certutil.exe File Encoding to Base64 Using the -encode Flag

Alerts on Windows certutil.exe executions using -encode to base64-encode a file.