Detection rules › Kusto Query Language

Ingress Tool Transfer - Certutil

Source
upstream

This detection addresses most of the known ways to utilize this binary for malicious/unintended purposes. It attempts to accommodate for most detection evasion techniques, like commandline obfuscation and binary renaming.

MITRE ATT&CK coverage

TacticTechniques
Defense EvasionT1027 Obfuscated Files or Information, T1140 Deobfuscate/Decode Files or Information, T1564.004 Hide Artifacts: NTFS File Attributes
Command & ControlT1105 Ingress Tool Transfer

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation
Security-Auditing4688A new process has been created.
Defender-DeviceProcessEvents9001000Process activity (any)

Stages and Predicates

Stage 1: source

DeviceProcessEvents

Stage 2: where

 macro "(Timestamp >= ago(Timeframe))"

Stage 3: where

or
  FileName eq "certutil.exe"
  ProcessCommandLine match "certutil"
  SHA1 eq "CertUtilFESha1"
  SHA1 eq "CertUtilPESha1"

Stage 4: extend

Stage 5: where

CleanProcessCommandLine match ["decode", "encode", "verify", "url"]

Stage 6: sort

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CleanProcessCommandLinematch
  • decode
  • encode
  • url
  • verify
FileNameeq
  • certutil.exe
ProcessCommandLinematch
  • certutil corpus 5 (sigma 5)
SHA1in
  • CertUtilFESha1
  • CertUtilPESha1