Karneades
c73a9e4164
Below is an example of a test - the command line does not
include the path nor the .exe. I think this comes from the
initial detection on the Image path and the later switch to
command line.
We could also use both the Image path and the Command Line.
Message : Process Create:
Image: C:\Windows\SysWOW64\certutil.exe
CommandLine: certutil xx -decode xxx
Hashes: SHA1=8186D64DD28CD63CA883B1D3CE5F07AEABAD67C0
ParentImage: C:\Windows\System32\cmd.exe
ParentCommandLine: "C:\Windows\system32\cmd.exe"
38 lines
1.2 KiB
YAML
38 lines
1.2 KiB
YAML
title: Suspicious Certutil Command
|
|
status: experimental
|
|
description: Detects a suspicious Microsoft certutil execution with sub commands like 'decode' sub command, which is sometimes used to decode malicious code with the built-in certutil utility
|
|
author: Florian Roth, juju4
|
|
references:
|
|
- https://twitter.com/JohnLaTwC/status/835149808817991680
|
|
- https://twitter.com/subTee/status/888102593838362624
|
|
- https://twitter.com/subTee/status/888071631528235010
|
|
- https://blogs.technet.microsoft.com/pki/2006/11/30/basic-crl-checking-with-certutil/
|
|
- https://www.trustedsec.com/2017/07/new-tool-release-nps_payload/
|
|
logsource:
|
|
product: windows
|
|
service: sysmon
|
|
detection:
|
|
selection:
|
|
EventID: 1
|
|
CommandLine:
|
|
- '*certutil * -decode *'
|
|
- '*certutil * -decodehex *'
|
|
- '*certutil *-urlcache* http*'
|
|
- '*certutil *-urlcache* ftp*'
|
|
- '*certutil *-URL*'
|
|
- '*certutil *-ping*'
|
|
condition: selection
|
|
fields:
|
|
- CommandLine
|
|
- ParentCommandLine
|
|
tags:
|
|
- attack.defense_evasion
|
|
- attack.t1140
|
|
- attack.s0189
|
|
- attack.g0007
|
|
falsepositives:
|
|
- False positives depend on scripts and administrative tools used in the monitored environment
|
|
level: high
|
|
|
|
|