Skip to content
skopnix
Detections · Rule
← Cortex XDR detectionsCortex XDR · Behaviour (ATT&CK technique)

certutil used to download a remote file (T1105)

XQLhighconfidence 80/100generated 2026-10-18

certutil.exe with -urlcache or -verifyctl and an http(s) URL — a LOLBin download of a second-stage payload. Observed for: APT-C-36, APT10, APT15, APT18, APT23, APT27 and 76 more.

ATT&CK
T1105 mitre ↗
Correlation
set the rule's MITRE tactic to TA0011 and technique to T1105
Linked actors
APT-C-36 · APT10 · APT15 · APT18 · APT23 · APT27 · APT28 · APT29 · APT3 · APT31 · APT32 · APT33 · APT35 · APT37 · APT39 · APT40 · APT41 · BackdoorDiplomacy · Beijing Group · blackbyte · BRONZE HIGHLAND · BRONZE STARLIGHT · Chimera · Cobalt · Confucius · DarkHotel · DustSquad · ENERGETIC BEAR · Evilnum · FIN13 · FIN8 · Flying Kitten · Fox Kitten · GALLIUM · Gamaredon Group · GOLD CABIN · HAFNIUM · HAZY TIGER · incransom · IndigoZebra · INDRIK SPIDER · Kimsuky · Lazarus Group · LazyScripter · LYCEUM · Medusa Group · Metador · Molerats · MosesStaff · MuddyWater · MUSTANG PANDA · Mustard Tempest · OilRig · PLATINUM · play · QUILTED TIGER · RANCOR · RAZOR TIGER · Rocke · Sandworm · Scattered Spider · ShinyHunters · SideCopy · Silence group · Silent Chollima · TA2541 · TA505 · TeamPCP · TeamTNT · The Gorgon Group · Tick · Tonto Team · Turla · UNC4393 · Void Manticore · Volatile Cedar · Volt Typhoon · Whitefly · WindShift · Winter Vivern · WIRTE · WIZARD SPIDER
False positives
Needs certutil, a download switch and an http(s) URL together; certutil hashing, encoding or CA administration does not match.

XQL query

skopnix-cortex-ttp-t1105-3ca1e9d8.xqldownload .xql ↓
dataset = xdr_data
| filter event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_START
| filter lowercase(action_process_image_name) = "certutil.exe" and (lowercase(action_process_image_command_line) contains "urlcache" or lowercase(action_process_image_command_line) contains "verifyctl") and lowercase(action_process_image_command_line) contains "http"
| fields _time, agent_hostname, actor_effective_username, action_process_image_name, action_process_image_command_line, actor_process_image_name, causality_actor_process_image_name
| sort desc _time

How to deploy on Cortex XDR

  1. 1.Paste the XQL into Incident Response > Investigation > Query Builder > XQL Search.
  2. 2.To alert, save it as a Correlation Rule and set the MITRE tactic and technique printed with the rule.
  3. 3.Schedule it on the interval you hunt at; keep the fields stage for the alert's columns.

Check · CVE rules read PAN-OS URL logs (panw_ngfw_url_raw), which need the NGFW integration and, for HTTPS, decryption.

References