Certutil.exe Abused as Downloader via -urlcache or -split Flag

Ankit Mehta@Secvyn

•updated Jun 27, 2026•0•0•2

Detects the use of certutil.exe to download files from a remote URL using the -urlcache or -split flags. This behavior is a common Living-off-the-Land (LotL) technique used by adversaries to bypass security controls and download secondary payloads.