Certutil LOLBin File Download or Base64 Decode/Encode

Ankit Mehta@Secvyn

•updated Jun 26, 2026•0•0•2

Detects the use of the Windows certutil.exe utility for potentially suspicious file operations, including downloading files from remote URLs via 'urlcache' or 'split', or encoding/decoding files. This is a common Living-off-the-Land (LotL) technique used by attackers to stage malicious payloads or deobfuscate malicious content.