1200kmSECURITY RESEARCH
Loading interactive filters…

1200KM / tool

certutil — Attack Tool

certutil is a command-line utility that can be used to obtain certificate authority information and configure Certificate Services.

Tool identity and evidence

Included because the active pinned ATT&CK object has type tool. This is an upstream classification, not an assurance of benignness or a recommendation to run it.

Aliases: certutil, certutil.exe

Primary tool reference

Existing author guides

No reviewed association in this snapshot.

Primary documentation

No reviewed association in this snapshot.

Connected ecosystem references

Linked tags

cloud-hosted-endpointnetwork-infrastructureonpremvirtualizationWindows
attack_toolattack_uses

Documented actor use

Explicit actor-to-software uses relationships in the pinned ATT&CK source. These links are historical behavior context, not attribution of current events.

Technique-specific simulations and detections

Detection links describe the associated behavior, not independently verified tool-specific signatures.

Telemetry context

Derived from the explicitly linked TTPs; not proof of sensor coverage for this tool.

Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.