Certutil (LOLBins and LOLScripts, Normalized Process Events)

Hunt Hypothesis

‘This detection uses Normalized Process Events to hunt Certutil activities’

KQL Query

imProcessCreate
| where Process has "certutil.exe"
// Uncomment the next line and add your commandLine Whitelisted/ignore terms.For example "urlcache"
// | where CommandLine !contains ("urlcache") 
| extend HostCustomEntity = Dvc, AccountCustomEntity = User

Analytic Rule Definition

id: 28233666-c235-4d55-b456-5cfdda29d62d
name: Certutil (LOLBins and LOLScripts, Normalized Process Events)
description: |
  'This detection uses Normalized Process Events to hunt Certutil activities'

requiredDataConnectors: []
tactics:
  - CommandAndControl
relevantTechniques:
  - T1105

query: |
  imProcessCreate
  | where Process has "certutil.exe"
  // Uncomment the next line and add your commandLine Whitelisted/ignore terms.For example "urlcache"
  // | where CommandLine !contains ("urlcache") 
  | extend HostCustomEntity = Dvc, AccountCustomEntity = User

entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: AccountCustomEntity
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: HostCustomEntity

Required Data Sources

False Positive Guidance

• Scenario: Admin imports a trusted root certificate using certutil -addstore -user TrustedRootCert.
  Filter: Exclude command lines containing "-addstore" or `“Trusted

MITRE ATT&CK Context

• Tactic: CommandAndControl
• Technique: T1105 — T1105

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/ASimProcess/imProcess_Certutil-LOLBins.yaml)