LOLBin Certutil
This query detects the use of certutil.exe.
CQL · Falcon Next-Gen SIEMCopy query
in(#event_simpleName, values=["ProcessRollup2","ProcessBlocked"])
| event_platform=Win and ImageFileName=/certutil.exe/i and CommandLine=/(https?:)/iCertutil.exe – A Windows certificate-management tool that attackers often misuse to download executables or script files (even into alternate data streams), as well as encode or decode payloads, aiding stealthy file delivery and evasion techniques.
LOLBin_Certutil.yml
T1105, T1564.004, T1027.013, T1140
ByteRay GmbH
Hunting
Endpoint
Insight
2025-08-06
2025-08-26
