File Decoded From Base64/Hex Via Certutil.EXE

Title: File Decoded From Base64/Hex Via Certutil.EXE
Status: test
Description:Detects the execution of certutil with either the "decode" or "decodehex" flags to decode base64 or hex encoded files. This can be abused by attackers to decode an encoded payload before execution
References:
  -https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
  -https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/
  -https://news.sophos.com/en-us/2021/04/13/compromised-exchange-server-hosting-cryptojacker-targeting-other-exchange-servers/
  -https://twitter.com/JohnLaTwC/status/835149808817991680
  -https://learn.microsoft.com/en-us/archive/blogs/pki/basic-crl-checking-with-certutil
  -https://lolbas-project.github.io/lolbas/Binaries/Certutil/
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community
Date: 2023-02-15
modified:2025-06-04
Tags:

• -'attack.stealth'
• -'attack.t1027'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\certutil.exe' OriginalFileName:'CertUtil.exe'   selection_cli:
    CommandLine|contains|windash:
      -'-decode '
      -'-decodehex '

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: high