Suspicious File Downloaded From Direct IP Via Certutil.EXE
Detects the execution of certutil with certain flags that allow the utility to download files from direct IPs.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.
detection:
selection_img:
- Image|endswith: '\certutil.exe'
- OriginalFileName: 'CertUtil.exe'
selection_flags:
CommandLine|contains:
- 'urlcache '
- 'verifyctl '
- 'URL '
selection_http:
CommandLine|contains:
- '://1'
- '://2'
- '://3'
- '://4'
- '://5'
- '://6'
- '://7'
- '://8'
- '://9'
# filter_local_ips:
# # Note: Uncomment this filter if you want to exclude local IPs
# CommandLine|contains:
# - '://10.' # 10.0.0.0/8
# - '://192.168.' # 192.168.0.0/16
# - '://172.16.' # 172.16.0.0/12
# - '://172.17.'
# - '://172.18.'
# - '://172.19.'
# - '://172.20.'
# - '://172.21.'
# - '://172.22.'
# - '://172.23.'
# - '://172.24.'
# - '://172.25.'
# - '://172.26.'
# - '://172.27.'
# - '://172.28.'
# - '://172.29.'
# - '://172.30.'
# - '://172.31.'
# - '://127.' # 127.0.0.0/8
# - '://169.254.' # 169.254.0.0/16
filter_main_seven_zip:
CommandLine|contains: '://7-' # For https://7-zip.org/
condition: all of selection_* and not 1 of filter_main_*False positive likelihood has not been assessed. Additional context may be needed during triage.
Suspicious Download Via Certutil.EXE
Detects the execution of certutil with certain flags that allow the utility to download files.
Detects similar activity. Both rules may fire on overlapping events.
Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
Detects the execution of certutil with certain flags that allow the utility to download files from file-sharing websites.
Detects similar activity. Both rules may fire on overlapping events.