CertUtil Abuse: File Download or Payload Decode (T1105/T1140)

Ankit Mehta@Secvyn

•updated Jun 27, 2026•0•0•3

Detects usage of the Windows certutil.exe utility with flags commonly associated with malicious activity, including downloading files from remote URLs or decoding/encoding files within temporary or application data directories.