File Encoded To Base64 Via Certutil.EXE

Title: File Encoded To Base64 Via Certutil.EXE
Status: test
Description:Detects the execution of certutil with the "encode" flag to encode a file to base64. This can be abused by threat actors and attackers for data exfiltration
References:
  -https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
  -https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/
  -https://lolbas-project.github.io/lolbas/Binaries/Certutil/
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)
Date: 2019-02-24
modified:2024-03-05
Tags:

• -'attack.stealth'
• -'attack.t1027'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\certutil.exe' OriginalFileName:'CertUtil.exe'   selection_cli:
    CommandLine|contains|windash: '-encode'
  condition:all of selection_*
Falsepositives:
  -As this is a general purpose rule, legitimate usage of the encode functionality will trigger some false positives. Apply additional filters accordingly
Level: medium