{"id":"ea0cdc3e-2239-4f26-a947-4e8f8224e464","title":"Suspicious File Encoded To Base64 Via Certutil.EXE","description":"Detects the execution of certutil with the \"encode\" flag to encode a file to base64 where the extensions of the file is suspicious","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-05-15","modified":"2024-03-05","tags":["attack.stealth","attack.t1027"],"technique_ids":["T1027"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://www.virustotal.com/gui/file/35c22725a92d5cb1016b09421c0a6cdbfd860fd4778b3313669b057d4a131cb7/behavior","https://www.virustotal.com/gui/file/427616528b7dbc4a6057ac89eb174a3a90f7abcf3f34e5a359b7a910d82f7a72/behavior","https://www.virustotal.com/gui/file/34de4c8beded481a4084a1fd77855c3e977e8ac643e5c5842d0f15f7f9b9086f/behavior","https://www.virustotal.com/gui/file/4abe1395a09fda06d897a9c4eb247278c1b6cddda5d126ce5b3f4f499e3b8fa2/behavior"],"source_path":"rules/windows/process_creation/proc_creation_win_certutil_encode_susp_extensions.yml","source_sha256":"101a627391a63cd14ccb58ef7374dc59df7d87a8facab601e7a9a24726fe64c1","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_certutil_encode_susp_extensions.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious File Encoded To Base64 Via Certutil.EXE\nid: ea0cdc3e-2239-4f26-a947-4e8f8224e464\nrelated:\n    - id: e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a\n      type: derived\nstatus: test\ndescription: Detects the execution of certutil with the \"encode\" flag to encode a file to base64 where the extensions of the file is suspicious\nreferences:\n    - https://www.virustotal.com/gui/file/35c22725a92d5cb1016b09421c0a6cdbfd860fd4778b3313669b057d4a131cb7/behavior\n    - https://www.virustotal.com/gui/file/427616528b7dbc4a6057ac89eb174a3a90f7abcf3f34e5a359b7a910d82f7a72/behavior\n    - https://www.virustotal.com/gui/file/34de4c8beded481a4084a1fd77855c3e977e8ac643e5c5842d0f15f7f9b9086f/behavior\n    - https://www.virustotal.com/gui/file/4abe1395a09fda06d897a9c4eb247278c1b6cddda5d126ce5b3f4f499e3b8fa2/behavior\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2023-05-15\nmodified: 2024-03-05\ntags:\n    - attack.stealth\n    - attack.t1027\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\certutil.exe'\n        - OriginalFileName: 'CertUtil.exe'\n    selection_cli:\n        CommandLine|contains|windash: '-encode'\n    selection_extension:\n        CommandLine|contains:\n            - '.acl'\n            - '.bat'\n            - '.doc'\n            - '.gif'\n            - '.jpeg'\n            - '.jpg'\n            - '.mp3'\n            - '.pdf'\n            - '.png'\n            - '.ppt'\n            - '.tmp'\n            - '.xls'\n            - '.xml'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_encode_susp_extensions/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1027","id":"T1027","name":"Obfuscated Files or Information","page":"techniques/enterprise/T1027/"}],"data_path":"data/detection-rules/ea0cdc3e-2239-4f26-a947-4e8f8224e464.json","kind":"sigma"}