SigmaHQ/rules/windows/sysmon/sysmon_susp_certutil_command.yml

title: Suspicious Certutil Command
status: experimental
description: Detetcs a suspicious Microsoft certutil execution with sub commands like 'decode' sub command, which is sometimes used to decode malicious code with the built-in certutil utility
author: Florian Roth
reference: 
    - https://twitter.com/JohnLaTwC/status/835149808817991680
    - https://twitter.com/subTee/status/888102593838362624
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 1
        Image: 
            - '*\certutil.exe * -decode *'
            - '*\certutil.exe * -decodehex *'
            - '*\certutil.exe -urlcache -split -f'
            - '*\certutil.exe *-f http*'
            - '*\certutil.exe *-f ftp*'
    condition: selection
falsepositives:
    - unknown
level: high