Uncommon Network Connection Initiated By Certutil.EXE

Title: Uncommon Network Connection Initiated By Certutil.EXE
Status: test
Description:Detects a network connection initiated by the certutil.exe utility. Attackers can abuse the utility in order to download malware or additional payloads.
References:
  -https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
Author: frack113, Florian Roth (Nextron Systems)
Date: 2022-09-02
modified:2024-05-31
Tags:

• -'attack.command-and-control'
• -'attack.t1105'

Logsource:

• category: network_connection
• product: windows

Detection:
  selection:
    Image|endswith: '\certutil.exe'
    Initiated: 'true'
    DestinationPort:
      -'80'
      -'135'
      -'443'
      -'445'

  condition:selection
Falsepositives:
  -Unknown
Level: high