CertUtil With Decode Argument

Hypothesis and description

CertUtil.exe may be used to encode and decode a file, including PE and script code. Encoding will convert a file to base64 with -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- tags. Malicious usage will include decoding a encoded file that was downloaded. Once decoded, it will be loaded by a parallel process. Note that there are two additional command switches that may be used - encodehex and decodehex. Similarly, the file will be encoded in HEX and later decoded for further execution. During triage, identify the source of the file being decoded. Review its contents or execution behavior for further analysis.

Platforms: Windows
Domain: Analytic
Subtypes: Process
Submitted: 2021-05-11
Contributors: Splunk Threat Research <research@splunk.com>

ATT&CK coverage

Technique	Tactics	Coverage
T1140 Deobfuscate/Decode Files or Information	Stealth (formerly Defense Evasion)	Moderate

1 technique. Links open MITRE ATT&CK.

T1140Deobfuscate/Decode Files or Information

D3FEND techniques MITRE maps to this analytic

D3-PSA Process Spawn Analysis

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

Pseudocode and implementations

PseudocodePseudocode - CertUtil with Decode ArgumentData model: CAR native

Pseudocode implementation of the Splunk search below

processes = search Process:Create
certutil_downloads = filter processes where (
  exe =”C:\Windows\System32\certutil.exe” AND command_line = *decode* )
output certutil_downloads

SplunkSplunk codeData model: Endpoint

To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Processes node.

| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe Processes.process=*decode* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

9 more in the full list

View CAR-2021-05-009 on car.mitre.org

Hypothesis and description

Technique

Tactics

Coverage

T1140 Deobfuscate/Decode Files or Information

Stealth (formerly Defense Evasion)

Moderate

Pseudocode and implementations

PseudocodePseudocode - CertUtil with Decode ArgumentData model: CAR native

Pseudocode implementation of the Splunk search below

processes = search Process:Create
certutil_downloads = filter processes where (
  exe =”C:\Windows\System32\certutil.exe” AND command_line = *decode* )
output certutil_downloads

SplunkSplunk codeData model: Endpoint

| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe Processes.process=*decode* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id