Query: detect Detects the execution of certutil with certain flags that allow the utility to download files from direct IPs. in logs
Matching passage: Sigma rule: Detects the execution of certutil with certain flags that allow the utility to download files from direct IPs.. Logsource: windows / process_creation. Rule: title: Suspicious File Downloaded From Direct IP Via Certutil.EXE id: 13e6fe51-d478-4c7e-b0f2-6da9b400a829 related: - id: 19b08b1c-861d-4e75-a1ef-ea0c1baf202b type: similar - id: 42a5f1e7-9603-4f6d-97ae-3f37d130d794 type: similar status: test description: Detects the execution of certutil with certain flags that allow the utility to download files from direct IPs. references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil - https://forensicitguy.github.io/agenttesla-vba-certutil-download/ - https://news.sophos.com/en-us/2021/04/13/compromised-exchange-server-hosting-cryptojacker-targeting-other-exchange-servers/ - https://twitter.com/egre55/status/1087685529016193025 - https://lolbas-project.github.io/lolbas/Binaries/Certutil/ - https://twitter.com/_JohnHammond/status/1708910264261980634 - https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-15 modified: 2025-12-01 tags: - attack.stealth - attack.t1027 - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \certutil.exe - OriginalFileName: CertUtil.exe selection_flags: CommandLine|contains: - 'urlcache ' - 'verifyctl ' - 'URL ' selection_http: CommandLine|contains: - ://1 - ://2 - ://3 - ://4 - ://5 - ://6 - ://7 - ://8 - ://9 filter_main_seven_zip: CommandLine|contains: ://7- condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_download_direct_ip/info.yml
Near-miss passage: Sigma rule: Detects the use of Ngrok, a utility used for port forwarding and tunneling, often used by threat actors to make local pr. Logsource: windows / process_creation. Rule: title: PUA - Ngrok Execution id: ee37eb7c-a4e7-4cd5-8fa4-efa27f1c3f31 status: test description: 'Detects the use of Ngrok, a utility used for port forwarding and tunneling, often used by threat actors to make local protected services publicly available. Involved domains are bin.equinox.io for download and *.ngrok.io for connections. ' references: - https://ngrok.com/docs - https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html - https://stackoverflow.com/questions/42442320/ssh-tunnel-to-ngrok-and-initiate-rdp - https://www.virustotal.com/gui/file/58d21840d915aaf4040ceb89522396124c82f325282f805d1085527e1e2ccfa1/detection - https://cybleinc.com/2021/02/15/ngrok-platform-abused-by-hackers-to-deliver-a-new-wave-of-phishing-attacks/ - https://twitter.com/xorJosh/status/1598646907802451969 - https://www.softwaretestinghelp.com/how-to-use-ngrok/ author: Florian Roth (Nextron Systems) date: 2021-05-14 modified: 2023-02-21 tags: - attack.command-and-control - attack.t1572 logsource: category: process_creation product: windows detection: selection1: CommandLine|contains: - ' tcp 139' - ' tcp 445' - ' tcp 3389' - ' tcp 5985' - ' tcp 5986' selection2: CommandLine|contains|all: - ' start ' - --all - --config - .yml selection3: Image|endswith: ngrok.exe CommandLine|contains: - ' tcp ' - ' http ' - ' authtoken ' selection4: CommandLine|contains: - '.exe authtoken ' - .exe start --all condition: 1 of selection* falsepositives: - Another tool that uses the command line switches of Ngrok - Ngrok http 3978 (https://learn.microsoft.com/en-us/azure/bot-service/bot-service-debug-channel-ngrok?view=azure-bot-service-4.0) level: high