tool
certutil is a command-line utility that can be used to obtain certificate authority information and configure Certificate Services. [1]
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
certutil has been used to decode binaries hidden inside certificate files as Base64 information.4
certutil can be used to install browser root certificates as a precursor to performing Adversary-in-the-Middle between connections to banking websites. Example command: certutil -addstore -f -user ROOT ProgramData\cert512121.der.5
Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
17th percentile · 83% of 825 ATT&CK software entries have more Enterprise techniques.
32nd percentile · 68% of 825 ATT&CK software entries have more tactics spanned.
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
49th percentile · 51% of 825 ATT&CK software entries have more detection rules per technique.
183 distinct rules cover the 4 techniques recorded for this tool. 132 Sigma · 51 Splunk.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Splunk | The following analytic detects the execution of 7z or 7za processes with command lines pointing to SMB network shares. (...) | Hunting | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Teoderick Contreras, Splunk | 2021-08-17 | 2026-05-13 | 01d29b48-ff6f-11eb-b81e-acde48001123 | |||
Detects execution of 7z in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2022-09-27 | 2026-06-05 | ec570e53-4c76-45a9-804d-dc3f355ff7a7 | ||||
Detects denied requests by Active Directory Certificate Services. (...) | Generic | test | - | windows | WinEventLog System | - | low | @SerkinValery | 2024-03-07 | — | 994bfd6d-0a2e-481e-a861-934069fcf5f5 | ||||
Splunk | The following analytic detects the execution of 7z.exe, a 7-Zip utility, spawned from rundll32.exe or dllhost.exe. (...) | Anomaly | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Michael Haag, Teoderick Contreras, Splunk | 2021-04-22 | 2026-05-13 | 9364ee8e-a39a-11eb-8f1d-acde48001122 | |||
Detects DNS queries made by "AppInstaller.EXE". (...) | Generic | test | dns | windows | Sysmon | - | medium | frack113 | 2021-11-24 | 2023-11-09 | 7cff77e1-9663-46a3-8260-17f2e1aa9d0a | ||||
Detects APT31 Judgement Panda activity as described in the Crowdstrike 2019 Global Threat Report | Emerging | test | process_creation | windows | Sysmon · WinEventLog Security | - | critical | Florian Roth (Nextron Systems) | 2019-02-21 | 2023-03-10 | 03e2746e-2b31-42f1-ab7a-eb39365b2422 | ||||
Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Victor Sergeev, oscd.community | 2020-10-09 | 2023-10-18 | eee00933-a761-4cd0-be70-c42fe91731e7 | ||||
Detects file creation events linked to the Axios NPM supply chain compromise. (...) | Emerging | experimental | file_event | linux | Sysmon | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | b7cb840c-11f6-47f7-b3ef-5524739c9077 | ||||
Detects file creation events linked to the Axios NPM supply chain compromise on macOS devices. (...) | Emerging | experimental | file_event | macos | - | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | 2db0458c-05c9-4069-a26f-77becd9c8c13 | ||||
Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. (...) | Emerging | experimental | process_creation | linux | Sysmon | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | 0a23a62d-c5b3-468b-a072-25064a9a8c87 | ||||
Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup. | Emerging | experimental | process_creation | macos | - | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | a09ee860-31b3-4586-8a68-0ebd74ce0e5f | ||||
Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...) | Emerging | experimental | process_creation | windows | Sysmon · WinEventLog Security | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | f6c27ecc-d890-4452-80e6-2e274a10e097 | ||||
Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Florian Roth (Nextron Systems) | 2020-01-29 | 2023-01-26 | e32d4572-9826-4738-b651-95fa63747e8a | ||||
Splunk | The following analytic detects the use of `bitsadmin.exe` with the `transfer` parameter to download a remote object. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Michael Haag, Sittikorn S | 2021-03-30 | 2026-10-02 | 80630ff4-8e4c-11eb-aab5-acde48001122 | |||
Detects execution of Chromium based browser in headless mode | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | Nasreddine Bencherchali (Nextron Systems) | 2023-09-12 | — | ef9dcfed-690c-4c5d-a9d1-482cd422225c | ||||
Splunk | The following analytic detects the use of CertUtil.exe with the 'decode' argument, which may indicate an attempt to decode a previously encoded file, potentially containing malicious payloads. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Michael Haag, Splunk | 2021-03-25 | 2026-10-02 | bfe94226-8c10-11eb-a4b3-acde48001122 | |||
Show when private keys are being exported from the device, or when new certificates are installed | Generic | test | authentication | - | Cisco AAA · Cisco | - | high | Austin Clark | 2019-08-12 | 2023-01-04 | 1f978c6a-4415-47fb-aca5-736a44d7ca3d | ||||
Splunk | The following analytic detects the execution of curl commands with insecure flags within the Cisco Isovalent environment. (...) | Anomaly | stable | process_creation | - | Cisco | - | medium | Bhavin Patel, Splunk | 2026-01-05 | 2026-10-02 | c16c4899-d3f7-461b-92c2-cc0ef5758855 | |||
Splunk | This analytic identifies the use of Chromium-based browsers (like Microsoft Edge) running in headless mode with the `--dump-dom` argument. (...) | Generic | stable | network_connection | - | Cisco NVM · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-07-01 | 2026-09-22 | cd0e816f-f67d-4dbe-a153-480b546e867e | |||
Splunk | This analytic detects unexpected outbound network connections initiated by known webserver processes such as `httpd.exe`, `nginx.exe`, or `tomcat.exe` to common file sharing or public content hosting services like GitHub, Discord CDN, Transfer.sh, or Pastebin. (...) | Generic | stable | network_connection | - | Cisco NVM · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-07-01 | 2026-09-22 | 1984f997-3b49-4d4b-a7e9-dc5dbf88370e | |||
Splunk | The following analytic detects potential reverse shell activity by identifying connections involving ports commonly associated with remote access tools, shell listeners, or tunneling utilities. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | d85c05c8-42c0-4e4a-87e7-4e1bb3e844e3 | |||
Splunk | The following analytic detects outbound connections to commonly abused file sharing and pastebin-style hosting domains. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | f7e5e792-d907-46c1-a58e-4ff974dc462a | |||
Splunk | The following analytic detects file transfers flagged as malware that occurred over non-standard ports (other than 80 and 443). (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-09 | 2026-09-22 | f26445a8-a6a2-4855-bec0-0c39e52e5b8f | |||
Splunk | The following analytic detects connections with a high Encrypted Visibility Engine (EVE) threat confidence score, indicating potentially malicious behavior within encrypted traffic. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | 8c15183e-2e70-4db4-86c3-88f8d9129b66 | |||
Splunk | The following analytic detects file downloads that were classified as malware by Cisco Secure Firewall Threat Defense. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-09 | 2026-09-22 | 3cc93f52-5aa6-4b7f-83b9-3430b1436813 | |||
Splunk | The following analytic detects repeated malware file downloads initiated by the same internal host (src) within a short time window. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-09 | 2026-09-22 | aeff2bb5-3483-48d4-9be8-c8976194be1e | |||
Splunk | This analytic identifies Snort intrusion signatures that have been triggered by ten or more distinct internal IP addresses within a one-hour window. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-16 | 2026-05-13 | a4c76d0a-56b6-44be-814b-939746c4d406 | |||
Splunk | The following analytic detects outbound connections initiated by command-line tools such as curl or wget. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | 173a1cb9-1814-4128-a9dc-f29dade89957 | |||
Various protocols maybe used to put data on the device for exfil or infil | Generic | test | authentication | - | Cisco AAA · Cisco | - | low | Austin Clark | 2019-08-12 | 2023-01-04 | 5e51acb2-bcbe-435b-99c6-0e3cd5e2aa59 | - | |||
Detects a suspicious command line execution that includes an URL and AppData string in the command l (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community | 2019-01-16 | 2021-11-27 | 1ac8666b-046f-4201-8aba-1951aaec03a3 | ||||
An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party ut (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2021-07-27 | 2026-06-05 | 9fbf5927-5261-4284-a71d-f681029ea574 | ||||
An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party ut (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2021-07-27 | 2022-12-25 | e2e80da2-8c66-4e00-ae3c-2eebd29f6b6d | ||||
Detects execution of "tar.exe" in order to create a compressed file. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | Nasreddine Bencherchali (Nextron Systems), AdmU3 | 2023-12-19 | — | 418a3163-3247-4b7b-9933-dcfcb7c52ea9 | ||||
Detects execution of "tar.exe" in order to extract compressed file. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | AdmU3 | 2023-12-19 | — | bf361876-6620-407a-812f-bfe11e51e924 | ||||
Adversaries can use curl to download payloads remotely and execute them. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Sreeman, Nasreddine Bencherchali (Nextron Systems) | 2020-01-13 | 2024-03-05 | 21dd6d38-2b18-4453-9404-a0fe4a0cc288 | ||||
Splunk | The following analytic detects the execution of the curl utility where the command line includes percent-encoded characters and explicit file output options (such as -o or --output). (...) | Anomaly | stable | process_creation | windows · linux | CrowdStrike · Sysmon · WinEventLog Security | - | medium | Nasreddine Bencherchali, Splunk | 2026-03-03 | 2026-05-13 | 9a8d5516-4c5e-11ef-9d42-acde48001122 | |||
Detects a curl process start on linux, which indicates a file download from a remote location or a s (...) | Generic | test | process_creation | linux | Sysmon | - | low | Nasreddine Bencherchali (Nextron Systems) | 2022-09-15 | — | ea34fb97-e2c4-4afb-810f-785e4459b194 | ||||
Detects a curl process start on Windows, which could indicates a file download from a remote locatio (...) | Hunting | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | Florian Roth (Nextron Systems) | 2022-07-05 | 2023-02-21 | bbeaed61-1990-4773-bf57-b81dbad7db2d | ||||
Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe. (...) | Emerging | test | file_event | windows | Sysmon | - | medium | Micah Babinski | 2023-10-15 | — | 1a433e1d-03d2-47a6-8063-ece992cf4e73 | ||||
An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network. | Generic | test | process_creation | linux | Linux Auditd | - | low | Timur Zinniatullin, oscd.community | 2019-10-21 | 2023-07-28 | a3b5e3e9-1b49-4119-8b8e-0344a01f21ee | ||||
Splunk | The following analytic detects the use of Certify or Certipy tools to enumerate Active Directory Certificate Services (AD CS) environments. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Steven Dick | 2023-07-28 | 2026-05-13 | e6d2dc61-a8b9-4b03-906c-da0ca75d71b8 | |||
Detects the execution of the hdiutil utility in order to mount disk images. | Generic | test | process_creation | macos | - | - | medium | Omar Khaled (@beacon_exe) | 2024-08-10 | — | bf241472-f014-4f01-a869-96f99330ca8c | ||||
Detects when a user enables DNS-over-HTTPS. (...) | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | Austin Songer | 2021-07-22 | 2023-08-17 | 04b45a8a-d11d-49e4-9acc-4a1b524407a5 | ||||
Detects the use of wget to download content to a suspicious directory | Generic | test | process_creation | linux | Sysmon | - | medium | Joseliyo Sanchez, @Joseliyo_Jstnk | 2023-06-02 | — | cf610c15-ed71-46e1-bdf8-2bd1a99de6c4 | ||||
Splunk | The following analytic detects suspicious file downloads by the Telegram application on a Windows system. (...) | Generic | stable | create_stream_hash | windows | Sysmon | - | medium | Teoderick Contreras, Splunk | 2021-05-07 | 2026-05-13 | 58194e28-ae5e-11eb-8912-acde48001122 | |||
Detects download of certain file types from hosts with dynamic DNS names (selected list) | Generic | test | proxy | - | - | - | medium | Florian Roth (Nextron Systems) | 2017-11-08 | 2023-05-18 | 195c1119-ef07-4909-bb12-e66f5e07bf3c | ||||
Detects executable access via webdav6. (...) | Generic | test | - | - | HTTP · Zeek | - | medium | SOC Prime, Adam Swan | 2020-05-01 | 2021-11-27 | aac2fd97-bcba-491b-ad66-a6edf89c71bf | ||||
Detects execution of the IEExec utility to download and execute files | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Nasreddine Bencherchali (Nextron Systems) | 2022-05-16 | 2023-11-09 | 9801abb8-e297-4dbf-9fbd-57dde0e830ad | ||||
Detects execution of a browser process with a URL argument pointing to a file with a potentially interesting extension. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) | 2022-01-11 | 2025-10-27 | 94771a71-ba41-4b6e-a757-b531372eaab6 | ||||
Detects when a user downloads a file from an IP based URL using CertOC.exe | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Nasreddine Bencherchali (Nextron Systems) | 2023-10-18 | — | b86f6dea-0b2f-41f5-bdcc-a057bd19cd6a |
96th percentile · 96% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.
54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
65th percentile · 65% of 825 ATT&CK software entries have this many mitigations per technique or fewer.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this tool’s 4 Enterprise techniques.
Technique Campaign use over its cumulative rule count.