Rule name: "Skopnix: certutil used to download a remote file (T1105)"
Rule type: Event
Test stack:
  - and when the event(s) were detected by one or more of [Microsoft Windows Security Event Log, Microsoft Windows Sysmon]
  - and when the event matches this AQL filter query: "Process Name" ILIKE 'certutil.exe' AND ("Process CommandLine" ILIKE '%urlcache%' OR "Process CommandLine" ILIKE '%verifyctl%') AND "Process CommandLine" ILIKE '%http%'
Response: dispatch new event / create offense indexed by Source IP; annotate "Skopnix T1105".
FP-safety: Needs certutil, a download switch and an http(s) URL together; certutil hashing, encoding or CA administration does not match.