Certutil abused for decode/urlcache by script host or Office process

Renata Cardoso@rcardososec

•updated Aug 10, 2026•2•0•3

Detects certutil.exe invoked with -decode or -urlcache arguments, spawned by a script host (wscript.exe/cscript.exe) or an Office process, indicating LOLBin abuse for payload decode/transfer