Sigma rule: Suspicious File Downloaded From Direct IP Via Certutil.EXE

Rule

Title

Suspicious File Downloaded From Direct IP Via Certutil.EXE

Status

test

Level

high

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2023-02-15

Modified

2025-12-01

File

rules/windows/process_creation/proc_creation_win_certutil_download_direct_ip.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the execution of certutil with certain flags that allow the utility to download files from direct IPs.

Log source

product

windows

category

process_creation

Detection

selection_img:
    - Image|endswith: '\certutil.exe'
    - OriginalFileName: 'CertUtil.exe'
selection_flags:
    CommandLine|contains:
        - 'urlcache '
        - 'verifyctl '
        - 'URL '
selection_http:
    CommandLine|contains:
        - '://1'
        - '://2'
        - '://3'
        - '://4'
        - '://5'
        - '://6'
        - '://7'
        - '://8'
        - '://9'
# filter_local_ips:
#     # Note: Uncomment this filter if you want to exclude local IPs
#     CommandLine|contains:
#         - '://10.' # 10.0.0.0/8
#         - '://192.168.' # 192.168.0.0/16
#         - '://172.16.' # 172.16.0.0/12
#         - '://172.17.'
#         - '://172.18.'
#         - '://172.19.'
#         - '://172.20.'
#         - '://172.21.'
#         - '://172.22.'
#         - '://172.23.'
#         - '://172.24.'
#         - '://172.25.'
#         - '://172.26.'
#         - '://172.27.'
#         - '://172.28.'
#         - '://172.29.'
#         - '://172.30.'
#         - '://172.31.'
#         - '://127.' # 127.0.0.0/8
#         - '://169.254.' # 169.254.0.0/16
filter_main_seven_zip:
    CommandLine|contains: '://7-' # For https://7-zip.org/
condition: all of selection_* and not 1 of filter_main_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.stealth
• attack.t1027
• attack.command-and-control
• attack.t1105

MITRE ATT&CK ids this rule names

• T1027
• T1105

Related rules

• 19b08b1c-861d-4e75-a1ef-ea0c1baf202b (similar)
• 42a5f1e7-9603-4f6d-97ae-3f37d130d794 (similar)

References

• https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
• https://forensicitguy.github.io/agenttesla-vba-certutil-download/
• https://news.sophos.com/en-us/2021/04/13/compromised-exchange-server-hosting-cryptojacker-targeting-other-exchange-servers/
• https://twitter.com/egre55/status/1087685529016193025
• https://lolbas-project.github.io/lolbas/Binaries/Certutil/
• https://twitter.com/_JohnHammond/status/1708910264261980634
• https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_certutil_download_direct_ip.yml