Certutil.exe Download Cradle or File Decode - T1105/T1140

Ankit Mehta@Secvyn

•updated Jun 30, 2026•3•0•1

Detects execution of Certutil.exe with arguments commonly used by adversaries for downloading files (urlcache) or decoding malicious payloads (decode/decodehex). These techniques are frequently used to bypass security controls and facilitate the delivery of secondary payloads or tools.