Payload Download Abuse via certutil -urlcache/-decode or bitsadmin /transfer
Detects the use of legitimate Windows binaries (LOLBins) certutil.exe and bitsadmin.exe for suspicious activities such as downloading files via URL or decoding encoded files. This rule explicitly excludes known legitimate administrative activity originating from Microsoft Configuration Manager (SCCM).
Microsoft Sentinel (KQL)
