Detection rules › Sigma
Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
Detects the execution of certutil with certain flags that allow the utility to download files from file-sharing websites.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Defense Evasion | T1027 Obfuscated Files or Information |
| Command & Control | T1105 Ingress Tool Transfer |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Sysmon | 1 | Process creation |
Stages and Predicates
Stage 1: all of selection_img
or:
Image|endswith: '\certutil.exe'
OriginalFileName: CertUtil.exe
Stage 2: all of selection_flags
or:
CommandLine|contains: 'URL '
CommandLine|contains: 'urlcache '
CommandLine|contains: 'verifyctl '
Stage 3: all of selection_http
or:
CommandLine|contains: .githubusercontent.com
CommandLine|contains: anonfiles.com
CommandLine|contains: cdn.discordapp.com
CommandLine|contains: ddns.net
CommandLine|contains: dl.dropboxusercontent.com
CommandLine|contains: ghostbin.co
CommandLine|contains: github.com
CommandLine|contains: glitch.me
CommandLine|contains: gofile.io
CommandLine|contains: hastebin.com
CommandLine|contains: mediafire.com
CommandLine|contains: mega.nz
CommandLine|contains: onrender.com
CommandLine|contains: pages.dev
CommandLine|contains: paste.ee
CommandLine|contains: pastebin.com
CommandLine|contains: pastebin.pl
CommandLine|contains: pastetext.net
CommandLine|contains: privatlab.com
CommandLine|contains: privatlab.net
CommandLine|contains: send.exploit.in
CommandLine|contains: sendspace.com
CommandLine|contains: storage.googleapis.com
CommandLine|contains: storjshare.io
CommandLine|contains: supabase.co
CommandLine|contains: temp.sh
CommandLine|contains: transfer.sh
CommandLine|contains: trycloudflare.com
CommandLine|contains: ufile.io
CommandLine|contains: w3spaces.com
CommandLine|contains: workers.dev
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
CommandLine | match |
|
Image | ends_with |
|
OriginalFileName | eq |
|