{"id":"82a6714f-4899-4f16-9c1e-9a333544d4c3","title":"File In Suspicious Location Encoded To Base64 Via Certutil.EXE","description":"Detects the execution of certutil with the \"encode\" flag to encode a file to base64 where the files are located in potentially suspicious locations","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-05-15","modified":"2024-03-05","tags":["attack.stealth","attack.t1027"],"technique_ids":["T1027"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://www.virustotal.com/gui/file/35c22725a92d5cb1016b09421c0a6cdbfd860fd4778b3313669b057d4a131cb7/behavior","https://www.virustotal.com/gui/file/427616528b7dbc4a6057ac89eb174a3a90f7abcf3f34e5a359b7a910d82f7a72/behavior","https://www.virustotal.com/gui/file/34de4c8beded481a4084a1fd77855c3e977e8ac643e5c5842d0f15f7f9b9086f/behavior","https://www.virustotal.com/gui/file/4abe1395a09fda06d897a9c4eb247278c1b6cddda5d126ce5b3f4f499e3b8fa2/behavior"],"source_path":"rules/windows/process_creation/proc_creation_win_certutil_encode_susp_location.yml","source_sha256":"684dc31d915fb022506f7c2fdc2e5614ad64349591bdd925a497e402811ecfc9","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_certutil_encode_susp_location.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: File In Suspicious Location Encoded To Base64 Via Certutil.EXE\nid: 82a6714f-4899-4f16-9c1e-9a333544d4c3\nrelated:\n    - id: e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a\n      type: derived\nstatus: test\ndescription: Detects the execution of certutil with the \"encode\" flag to encode a file to base64 where the files are located in potentially suspicious locations\nreferences:\n    - https://www.virustotal.com/gui/file/35c22725a92d5cb1016b09421c0a6cdbfd860fd4778b3313669b057d4a131cb7/behavior\n    - https://www.virustotal.com/gui/file/427616528b7dbc4a6057ac89eb174a3a90f7abcf3f34e5a359b7a910d82f7a72/behavior\n    - https://www.virustotal.com/gui/file/34de4c8beded481a4084a1fd77855c3e977e8ac643e5c5842d0f15f7f9b9086f/behavior\n    - https://www.virustotal.com/gui/file/4abe1395a09fda06d897a9c4eb247278c1b6cddda5d126ce5b3f4f499e3b8fa2/behavior\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2023-05-15\nmodified: 2024-03-05\ntags:\n    - attack.stealth\n    - attack.t1027\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\certutil.exe'\n        - OriginalFileName: 'CertUtil.exe'\n    selection_cli:\n        CommandLine|contains|windash: '-encode'\n    selection_extension:\n        CommandLine|contains:\n            # Note: Add more suspicious locations to increase coverage\n            - '\\AppData\\Roaming\\'\n            - '\\Desktop\\'\n            - '\\Local\\Temp\\'\n            - '\\PerfLogs\\'\n            - '\\Users\\Public\\'\n            - '\\Windows\\Temp\\'\n            - '$Recycle.Bin'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_encode_susp_location/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1027","id":"T1027","name":"Obfuscated Files or Information","page":"techniques/enterprise/T1027/"}],"data_path":"data/detection-rules/82a6714f-4899-4f16-9c1e-9a333544d4c3.json","kind":"sigma"}