Background

We looked for a fresh news item from the past 48 hours to anchor this guide. A WebSearch on 1 November 2026 returned nothing dated 31 October or 1 November (the newest results were from early August 2026), so this is an evergreen technique guide. No evidence found as of 1 November 2026 in that search of a new certutil-specific campaign; that reflects the limits of our search, not the threat landscape.

Certutil.exe is a signed Windows binary for managing certificates. Attackers use it for two jobs: pulling a file from a remote host, and decoding a Base64 or hex blob into an executable, archive or script. The MITRE ATT&CK page for T1140 (which we opened) names certutil as an example, noting its use to decode a remote access tool hidden inside a certificate file. The page shows version 2.0, last modified 11 September 2026.

What ATT&CK reports

From the T1140 procedure examples we read, certutil decoding is attributed to APT28 (a macro running certutil -decode on a text file holding a Base64 payload), Earth Lusca, FIN13, FIN7, Higaisa, KONNI, menuPass, OilRig, StrelaStealer and the 2025 Poland wiper attacks campaign (C0063). This is a single-source summary. We did not open the underlying reports for each entry.

The T1140 page was long and our fetch was truncated, so we did not read its detection strategy or mitigations sections.

Detection 1: certutil with download flags (Sigma)

SigmaHQ publishes “Suspicious Download Via Certutil.EXE” (status test, level medium, authors include Florian Roth and Nasreddine Bencherchali, created 2023-02-15, last modified 2025-12-01). Our fetch tool returned only a summary of it, not the YAML, so we could not read its exact switch list. The rule below is our own version, built from switches we know certutil supports (-urlcache, -verifyctl, -split). Untested.

title: Certutil Remote File Retrieval (own draft)
status: experimental
description: Untested. certutil.exe with a URL and a download-capable switch.
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: '\certutil.exe'
    - OriginalFileName: 'CertUtil.exe'
  selection_flags:
    CommandLine|contains|windash:
      - '-urlcache'
      - '-verifyctl'
  selection_url:
    CommandLine|contains:
      - 'http://'
      - 'https://'
      - 'ftp://'
  condition: all of selection_*
falsepositives:
  - Administrators refreshing certificate revocation data by hand
  - Software deployment scripts that fetch certificates
level: medium
tags:
  - attack.t1105

The OriginalFileName clause catches a renamed copy of the binary. Our assessment: a path to certutil via a copied file named something else is common enough to keep that clause.

Detection 2: certutil decode of staged files (Sigma)

Untested. This targets the decode pattern MITRE describes.

title: Certutil Decode of Staged File (own draft)
status: experimental
description: Untested. certutil -decode or -decodehex writing an output file.
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: '\certutil.exe'
    - OriginalFileName: 'CertUtil.exe'
  selection_decode:
    CommandLine|contains|windash:
      - '-decode '
      - '-decodehex '
  condition: all of selection_*
falsepositives:
  - Build or packaging scripts that decode Base64 certificates
level: medium
tags:
  - attack.t1140

Detection 3: KQL for both patterns with parent context

Untested. Written by us, not validated against production data. Tune the allowlist of parents to your estate.

DeviceProcessEvents
| where Timestamp > ago(14d)
| where FileName =~ "certutil.exe" or ProcessVersionInfoOriginalFileName =~ "CertUtil.exe"
| extend Download = ProcessCommandLine matches regex @"(?i)-(urlcache|verifyctl)" and ProcessCommandLine matches regex @"(?i)(https?|ftp)://"
| extend Decode = ProcessCommandLine matches regex @"(?i)-decode(hex)?\s"
| where Download or Decode
| project Timestamp, DeviceName, AccountName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine, Download, Decode
| order by Timestamp desc

Detection 4: certutil network and file output

Untested. Certutil connecting to a public address is rare on most endpoints.

DeviceNetworkEvents
| where Timestamp > ago(14d)
| where InitiatingProcessFileName =~ "certutil.exe"
| where RemoteIPType == "Public"
| project Timestamp, DeviceName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort

Our assessment, not sourced: this query survives command-line obfuscation better than the string matches, though a legitimate certificate or CRL fetch will also appear. Join the result to DeviceFileEvents for files created by certutil in user-writable paths to see what landed on disk.

Triage and response

  1. Capture the full command line and parent process. Office, script hosts and browsers as parent raise priority.
  2. Recover the output file or the source URL content and detonate in isolation.
  3. Check what executed the output file in the following minutes.
  4. Scope the account and host for follow-on activity.

Hardening: a WDAC or AppLocker policy that blocks certutil for standard users, or an egress rule denying it direct internet access. Validate in audit mode first.

Sources and gaps

Opened: MITRE ATT&CK T1140 (https://attack.mitre.org/techniques/T1140/), first part only; MITRE ATT&CK T1197 (https://attack.mitre.org/techniques/T1197/), used only to pick a topic; the SigmaHQ certutil download rule (raw.githubusercontent.com), summary only. Search attempted: WebSearch for news on 31 October 2026, which returned nothing recent. Not opened: the individual threat reports behind MITRE’s examples, the certutil Microsoft documentation, and the T1105 page. The switch names -urlcache, -verifyctl, -decode and -decodehex come from our own knowledge and were not confirmed in an opened source. No IOCs are given because we have none from a verified source. None of our queries were tested against live telemetry.