Skip to content
skopnix
Detections · Rule
← IBM QRadar detectionsIBM QRadar · Behaviour (ATT&CK technique)

certutil used to download a remote file (T1105)

AQLhighconfidence 80/100generated 2026-10-18

certutil.exe with -urlcache or -verifyctl and an http(s) URL — a LOLBin download of a second-stage payload. Observed for: APT-C-36, APT10, APT15, APT18, APT23, APT27 and 76 more.

ATT&CK
T1105 mitre ↗
Linked actors
APT-C-36 · APT10 · APT15 · APT18 · APT23 · APT27 · APT28 · APT29 · APT3 · APT31 · APT32 · APT33 · APT35 · APT37 · APT39 · APT40 · APT41 · BackdoorDiplomacy · Beijing Group · blackbyte · BRONZE HIGHLAND · BRONZE STARLIGHT · Chimera · Cobalt · Confucius · DarkHotel · DustSquad · ENERGETIC BEAR · Evilnum · FIN13 · FIN8 · Flying Kitten · Fox Kitten · GALLIUM · Gamaredon Group · GOLD CABIN · HAFNIUM · HAZY TIGER · incransom · IndigoZebra · INDRIK SPIDER · Kimsuky · Lazarus Group · LazyScripter · LYCEUM · Medusa Group · Metador · Molerats · MosesStaff · MuddyWater · MUSTANG PANDA · Mustard Tempest · OilRig · PLATINUM · play · QUILTED TIGER · RANCOR · RAZOR TIGER · Rocke · Sandworm · Scattered Spider · ShinyHunters · SideCopy · Silence group · Silent Chollima · TA2541 · TA505 · TeamPCP · TeamTNT · The Gorgon Group · Tick · Tonto Team · Turla · UNC4393 · Void Manticore · Volatile Cedar · Volt Typhoon · Whitefly · WindShift · Winter Vivern · WIRTE · WIZARD SPIDER
False positives
Needs certutil, a download switch and an http(s) URL together; certutil hashing, encoding or CA administration does not match.

AQL search

skopnix-qradar-ttp-t1105-43d91e27.aqldownload .aql ↓
SELECT DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS event_time, LOGSOURCENAME(logsourceid) AS log_source, sourceip, username, "Process Name", "Process CommandLine"
FROM events
WHERE "Process Name" ILIKE 'certutil.exe' AND ("Process CommandLine" ILIKE '%urlcache%' OR "Process CommandLine" ILIKE '%verifyctl%') AND "Process CommandLine" ILIKE '%http%'
LAST 7 DAYS

CRE rule (build in Offenses > Rules)

download .txt ↓
Rule name: "Skopnix: certutil used to download a remote file (T1105)"
Rule type: Event
Test stack:
  - and when the event(s) were detected by one or more of [Microsoft Windows Security Event Log, Microsoft Windows Sysmon]
  - and when the event matches this AQL filter query: "Process Name" ILIKE 'certutil.exe' AND ("Process CommandLine" ILIKE '%urlcache%' OR "Process CommandLine" ILIKE '%verifyctl%') AND "Process CommandLine" ILIKE '%http%'
Response: dispatch new event / create offense indexed by Source IP; annotate "Skopnix T1105".
FP-safety: Needs certutil, a download switch and an http(s) URL together; certutil hashing, encoding or CA administration does not match.

How to deploy on IBM QRadar

  1. 1.Create the reference set from its spec (Reference Data API, or Admin > Reference Set Management) and schedule the skopnix feed load.
  2. 2.Paste the AQL into Log Activity > Advanced Search to hunt the last seven days.
  3. 3.For alerting, build the CRE rule from the test stack shown and exclude your known-good building block.

Check · Custom properties ("URL Host", "URL", "File Hash", "Process CommandLine") come from your DSMs and content extensions; rename them if yours differ.

References