Sigma detection rules, expert-reviewed

Suspicious Certutil Download and Certificate Installation via Living-off-the-Land

This rule detects certutil.exe being used to download files or install root certificates, a living-off-the-land technique observed in the ToolShell espionage intrusion. Certutil is frequently abused to stage second-stage payloads and add attacker certificates.

Suspicious Remote File Download via certutil URLCache (via process_creation)

This rule detects certutil.exe downloading a file from a remote URL using the urlcache and split flags. Rapid7 observed this living-off-the-land download technique in an exposed WebDAV malware delivery lab used to pull additional tooling onto compromised hosts. certutil is a certificate utility and its use as a file downloader is a well-known ingress and defense evasion technique.

Suspicious File Download via Certutil URLCache

This rule detects the certutil utility used with urlcache to download a remote file over HTTP, a living-off-the-land technique seen after CVE-2025-31324 exploitation of SAP NetWeaver. Attackers use certutil to retrieve second-stage payloads while evading application controls. This LOLBIN download behavior is rarely legitimate on servers.

Malicious certutil Decodehex Payload Reconstruction by DarkGate

This rule detects certutil being run with the decodehex option to reconstruct a binary from a downloaded hex-encoded file, a step DarkGate uses to rebuild an AutoHotkey interpreter from a dropped a.bin file. Abusing certutil for decoding is a living-off-the-land technique that evades signature-based download controls. Detecting this exposes payload deobfuscation during the DarkGate infection chain.

Suspicious StrelaStealer Base64 Payload Decode via Certutil (via process_creation)

This rule detects certutil being used with the decode and force flags to convert a Base64 encoded file into an executable payload, the deobfuscation step in the StrelaStealer infection chain. Because certutil decode is a living off the land technique for staging hidden binaries, this usage warrants review as likely payload unpacking.

Suspicious File Download via certutil URLCache (via process_creation)

This rule detects certutil being used with the urlcache option to retrieve a remote file over HTTP, a living-off-the-land download technique used via a webshell to fetch a backdoor in a ShadowPad intrusion. certutil is not a legitimate file downloader in normal administration. Using a signed binary to pull payloads evades application controls and network monitoring.

Malicious Root Certificate Installed via certutil addstore for AiTM Interception

This rule detects certutil.exe adding a certificate to the root or CA store using the addstore and Enterprise options. Microsoft observed Secret Blizzard installing a rogue root certificate to enable adversary-in-the-middle interception of diplomat traffic. Trusting an attacker root certificate allows silent TLS decryption, so this command reveals the interception setup.

Malicious Root Certificate Installation via certutil

This rule detects certutil adding a certificate to the LocalMachine Root store which BrowserVenom performs so its proxy can transparently intercept TLS traffic. Installing an attacker certificate into the trusted root store undermines HTTPS validation across the whole system. Root store additions by certutil outside managed deployments deserve scrutiny.

Suspicious File Download via certutil urlcache

This rule detects certutil used with urlcache split and force flags to download a remote file, a living-off-the-land ingress technique observed across the incident-response cases from Kaspersky's review. certutil is not a legitimate download utility, so this argument combination reliably flags attacker payload retrieval.

Malicious File Download via Certutil URL Cache (via process_creation)

This rule detects certutil being used with its URL cache and split switches to download a remote file over HTTP. The BadPilot campaign abuses certutil as a living-off-the-land downloader to fetch additional tooling, so this ingress-tool-transfer pattern indicates staging of second-stage payloads.

Suspicious File Download via CertUtil Linked to Salt Typhoon

This rule detects certutil.exe used with URL cache or decode switches to retrieve or stage remote content, an ingress tool transfer technique used by Salt Typhoon. Attackers abuse this signed LOLBin to pull payloads while evading download controls, so certutil download and decode invocations are a well-known malicious tradecraft signal.

Suspicious Root Certificate Installation via certutil (via process_creation)

This rule detects BlotchyQuasar installing an attacker root certificate into the enterprise trust store with certutil to enable interception of banking sessions. The addstore enterprise root combination applied to a dropped certificate file is a hallmark of trust subversion. Endpoints rarely add enterprise root certificates this way.

Malicious Certutil URL Cache Download of Remote Payload

This rule detects certutil.exe being used with the urlcache and split flags to download a remote executable, a living-off-the-land technique used in the intrusion analyzed by Huntress to fetch agent.exe. Certutil is a certificate utility and its use to retrieve arbitrary files over HTTP is almost always malicious ingress tool transfer. Attackers rely on it to evade controls that block common download utilities.

Certutil Decoding Encoded Payload to Executable

This rule detects certutil.exe invoked with the decode option to convert an encoded file back into an executable, a deobfuscation step that evades content inspection of the transferred payload. Huntress observed this after a compromised MSSQL host fetched a PHP-served payload and reconstructed it on disk. Using certutil to decode files is a well-known living-off-the-land technique for payload staging.

Suspicious File Download via certutil urlcache

This rule detects certutil downloading a remote file with the urlcache flag, used after WS_FTP exploitation to pull a payload into the Windows Temp directory. Certutil is a certificate utility and its use to fetch content over HTTP is a well known living-off-the-land ingress and proxy download technique.