MSI Installer Downloaded via Certutil
Detects certutil.exe being used to download an MSI file. This activity is often associated with adversaries using living-off-the-land binaries (LOLBINs) to download malicious payloads.
Microsoft Sentinel (KQL)
Detects certutil.exe being used to download an MSI file. This activity is often associated with adversaries using living-off-the-land binaries (LOLBINs) to download malicious payloads.
Already have an account?