Submission Date: 2021/05/11

Update Date:

Information Domain: Analytic

Data Subtypes: Process

Analytic Type: TTP

Applicable Platforms: Windows

Contributors: Splunk Threat Research



CertUtil.exe may be used to encode and decode a file, including PE and script code. Encoding will convert a file to base64 with -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- tags. Malicious usage will include decoding a encoded file that was downloaded. Once decoded, it will be loaded by a parallel process. Note that there are two additional command switches that may be used - encodehex and decodehex. Similarly, the file will be encoded in HEX and later decoded for further execution. During triage, identify the source of the file being decoded. Review its contents or execution behavior for further analysis.

ATT&CK Detections

Technique Subtechnique(s) Tactic(s) Level of Coverage
Deobfuscate/Decode Files or Information N/A Defense Evasion Moderate

D3FEND Techniques

ID Name
D3-PSA Process Spawn Analysis

Data Model References

Object Action Field
process create exe
process create command_line

Implementations

Pseudocode – CertUtil with Decode Argument (Pseudocode, CAR native)

Pseudocode implementation of the Splunk search below

processes = search Process:Create
certutil_downloads = filter processes where (
  exe =”C:\Windows\System32\certutil.exe” AND command_line = *decode* )
output certutil_downloads

Splunk code (Splunk, Endpoint)

To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Processes node.

| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe Processes.process=*decode* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id

Unit Tests

Test Case 1

Configurations: Using Splunk Attack Range

Replay the detection dataset using the Splunk attack range with the commands below

python attack_range.py replay -dn data_dump [--dump NAME_OF_DUMP]

Test Case 2

Configurations: Using Invoke-AtomicRedTeam

execute the atomic test T1140 against a Windows target.

Invoke-AtomicTest T1140