{"id":"cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7","title":"File Decoded From Base64/Hex Via Certutil.EXE","description":"Detects the execution of certutil with either the \"decode\" or \"decodehex\" flags to decode base64 or hex encoded files. This can be abused by attackers to decode an encoded payload before execution","author":"Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community","status":"test","level":"high","date":"2023-02-15","modified":"2025-06-04","tags":["attack.stealth","attack.t1027"],"technique_ids":["T1027"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil","https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/","https://news.sophos.com/en-us/2021/04/13/compromised-exchange-server-hosting-cryptojacker-targeting-other-exchange-servers/","https://twitter.com/JohnLaTwC/status/835149808817991680","https://learn.microsoft.com/en-us/archive/blogs/pki/basic-crl-checking-with-certutil","https://lolbas-project.github.io/lolbas/Binaries/Certutil/"],"source_path":"rules/windows/process_creation/proc_creation_win_certutil_decode.yml","source_sha256":"8498b3ca91281489dbc9a4ea04479592d4f4535c9c841ac9b30551f49d2a0a01","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_certutil_decode.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: File Decoded From Base64/Hex Via Certutil.EXE\nid: cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7\nstatus: test\ndescription: Detects the execution of certutil with either the \"decode\" or \"decodehex\" flags to decode base64 or hex encoded files. This can be abused by attackers to decode an encoded payload before execution\nreferences:\n    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil\n    - https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/\n    - https://news.sophos.com/en-us/2021/04/13/compromised-exchange-server-hosting-cryptojacker-targeting-other-exchange-servers/\n    - https://twitter.com/JohnLaTwC/status/835149808817991680\n    - https://learn.microsoft.com/en-us/archive/blogs/pki/basic-crl-checking-with-certutil\n    - https://lolbas-project.github.io/lolbas/Binaries/Certutil/\nauthor: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community\ndate: 2023-02-15\nmodified: 2025-06-04\ntags:\n    - attack.stealth\n    - attack.t1027\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\certutil.exe'\n        - OriginalFileName: 'CertUtil.exe'\n    selection_cli:\n        CommandLine|contains|windash:\n            - '-decode ' # Decode Base64\n            - '-decodehex ' # Decode Hex\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_decode/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1027","id":"T1027","name":"Obfuscated Files or Information","page":"techniques/enterprise/T1027/"}],"data_path":"data/detection-rules/cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7.json","kind":"sigma"}