certutil is a command-line utility that can be used to obtain certificate authority information and configure Certificate Services.
| Technique | Procedure example |
|---|---|
| T1105 Ingress Tool Transfer |
certutil can be used to download files from a given URL. |
| T1140 Deobfuscate/Decode Files or Information |
certutil has been used to decode binaries hidden inside certificate files as Base64 information. |
| T1553.004 Install Root Certificate |
certutil can be used to install browser root certificates as a precursor to performing Adversary-in-the-Middle between connections to banking websites. Example command: |
| T1560.001 Archive via Utility |
certutil may be used to Base64 encode collected data. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
