Sigma rule: File Encoded To Base64 Via Certutil.EXE

Rule

Title

File Encoded To Base64 Via Certutil.EXE

Status

test

Level

medium

Author

Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)

Date

2019-02-24

Modified

2024-03-05

File

rules/windows/process_creation/proc_creation_win_certutil_encode.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the execution of certutil with the "encode" flag to encode a file to base64. This can be abused by threat actors and attackers for data exfiltration

Log source

product

windows

category

process_creation

Detection

selection_img:
    - Image|endswith: '\certutil.exe'
    - OriginalFileName: 'CertUtil.exe'
selection_cli:
    CommandLine|contains|windash: '-encode'
condition: all of selection_*

False positives (as the rule lists them)

• As this is a general purpose rule, legitimate usage of the encode functionality will trigger some false positives. Apply additional filters accordingly

Tags

• attack.stealth
• attack.t1027

MITRE ATT&CK ids this rule names

• T1027

References

• https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
• https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/
• https://lolbas-project.github.io/lolbas/Binaries/Certutil/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_certutil_encode.yml