Cortex XDR
#Scenario
Hunt adversaries attempting to weaponise trusted certificate utility to pull down external payloads whilst exploiting local caching to mask their digital footprints.
markdown
> Make sure you're comfortable with the results in your own environment before using this more widely.
# Snippet - Certutil download via URL cache.
## Scenario
Scenario: a scenario where `certutil.exe` is repurposed as a download tool via `-urlcache -split -f`. It remains a popular LOLBin downloader because it ships with Windows and is rarely blocked.
Logic: triggers on the documented downloader flags and on any plain HTTP
reference in a certutil command line. Pair with `action_external_hostname` to see what was fetched.
- [https://attack.mitre.org/techniques/T1105/](https://attack.mitre.org/techniques/T1105/)
- [https://lolbas-project.github.io/lolbas/Binaries/Certutil/](https://lolbas-project.github.io/lolbas/Binaries/Certutil/)xql
// Make sure you're comfortable with the results in your own environment before using this more widely.
dataset = xdr_data
| filter event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_START
| filter lowercase(action_process_image_name) = "certutil.exe"
| filter lowercase(action_process_image_command_line) contains "-urlcache"
or lowercase(action_process_image_command_line) contains "-verifyctl"
or lowercase(action_process_image_command_line) contains "http"
| fields _time, agent_hostname, actor_effective_username,
causality_actor_process_image_name, action_process_image_command_line
| limit 200