Suspicious File Encoded To Base64 Via Certutil.EXE

Title: Suspicious File Encoded To Base64 Via Certutil.EXE
Status: test
Description:Detects the execution of certutil with the "encode" flag to encode a file to base64 where the extensions of the file is suspicious
References:
  -https://www.virustotal.com/gui/file/35c22725a92d5cb1016b09421c0a6cdbfd860fd4778b3313669b057d4a131cb7/behavior
  -https://www.virustotal.com/gui/file/427616528b7dbc4a6057ac89eb174a3a90f7abcf3f34e5a359b7a910d82f7a72/behavior
  -https://www.virustotal.com/gui/file/34de4c8beded481a4084a1fd77855c3e977e8ac643e5c5842d0f15f7f9b9086f/behavior
  -https://www.virustotal.com/gui/file/4abe1395a09fda06d897a9c4eb247278c1b6cddda5d126ce5b3f4f499e3b8fa2/behavior
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-15
modified:2024-03-05
Tags:

• -'attack.stealth'
• -'attack.t1027'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\certutil.exe' OriginalFileName:'CertUtil.exe'   selection_cli:
    CommandLine|contains|windash: '-encode'
  selection_extension:
    CommandLine|contains:
      -'.acl'
      -'.bat'
      -'.doc'
      -'.gif'
      -'.jpeg'
      -'.jpg'
      -'.mp3'
      -'.pdf'
      -'.png'
      -'.ppt'
      -'.tmp'
      -'.xls'
      -'.xml'

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: high