Skip to content
skopnix
Detections · Rule
← Sigma detectionsSigma · Behaviour (ATT&CK technique)

certutil used to download a remote file (T1105)

SIGhighconfidence 80/100generated 2026-10-18

certutil.exe with -urlcache or -verifyctl and an http(s) URL — a LOLBin download of a second-stage payload. Observed for: APT-C-36, APT10, APT15, APT18, APT23, APT27 and 76 more.

ATT&CK
T1105 mitre ↗
Linked actors
APT-C-36 · APT10 · APT15 · APT18 · APT23 · APT27 · APT28 · APT29 · APT3 · APT31 · APT32 · APT33 · APT35 · APT37 · APT39 · APT40 · APT41 · BackdoorDiplomacy · Beijing Group · blackbyte · BRONZE HIGHLAND · BRONZE STARLIGHT · Chimera · Cobalt · Confucius · DarkHotel · DustSquad · ENERGETIC BEAR · Evilnum · FIN13 · FIN8 · Flying Kitten · Fox Kitten · GALLIUM · Gamaredon Group · GOLD CABIN · HAFNIUM · HAZY TIGER · incransom · IndigoZebra · INDRIK SPIDER · Kimsuky · Lazarus Group · LazyScripter · LYCEUM · Medusa Group · Metador · Molerats · MosesStaff · MuddyWater · MUSTANG PANDA · Mustard Tempest · OilRig · PLATINUM · play · QUILTED TIGER · RANCOR · RAZOR TIGER · Rocke · Sandworm · Scattered Spider · ShinyHunters · SideCopy · Silence group · Silent Chollima · TA2541 · TA505 · TeamPCP · TeamTNT · The Gorgon Group · Tick · Tonto Team · Turla · UNC4393 · Void Manticore · Volatile Cedar · Volt Typhoon · Whitefly · WindShift · Winter Vivern · WIRTE · WIZARD SPIDER
False positives
Needs certutil, a download switch and an http(s) URL together; certutil hashing, encoding or CA administration does not match.

Sigma rule

skopnix-sigma-ttp-t1105-c87371ac.ymldownload .yml ↓
title: Skopnix - certutil used to download a remote file (T1105)
id: d8347c43-8579-5ab4-a520-de0131e52ae6
status: experimental
description: 'certutil.exe with -urlcache or -verifyctl and an http(s) URL — a LOLBin download of a second-stage payload. Observed for: APT-C-36, APT10, APT15, APT18, APT23, APT27 and 76 more.'
references:
  - https://attack.mitre.org/techniques/T1105/
  - https://skopnix.com/actors/apt-c-36
  - https://skopnix.com/actors/apt10
  - https://skopnix.com/actors/apt15
  - https://skopnix.com/actors/apt18
  - https://skopnix.com/actors/apt23
  - https://skopnix.com/actors/apt27
  - https://skopnix.com/actors/apt28
  - https://skopnix.com/actors/apt29
  - https://skopnix.com/actors/apt3
  - https://skopnix.com/actors/apt31
author: skopnix
date: '2026-10-18'
tags:
  - attack.command-and-control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: \certutil.exe
  selection_switch:
    CommandLine|contains:
      - urlcache
      - verifyctl
  selection_url:
    CommandLine|contains: http
  condition: all of selection_*
falsepositives:
  - Legacy scripts that fetch certificates or CRLs with certutil -urlcache (baseline by URL and parent process)
level: high

How to deploy on Sigma

  1. 1.Convert for your SIEM with sigma-cli / pySigma, e.g. sigma convert -t splunk -p sysmon rule.yml.
  2. 2.Run it as a hunt first: every rule ships as status experimental.
  3. 3.Promote to an alert once a week of results is clean on your data.

Check · The processing pipeline must map the logsource (firewall, dns, proxy, webserver, process_creation) to your field names.

References