Suspicious Certutil Execution for File Download or Encoding
Detects the usage of certutil.exe to download files, or encode/decode data. This behavior is commonly associated with Living Off The Land Binaries (LOLBins) exploitation to bypass security controls.
Microsoft Sentinel (KQL)
