Payload Decoded via CertUtil

[rule]
description = """
Identifies when attempts to decode file or information using the Microsoft built-in CertUtil utility. malware droppers
may leverage this technique to deobfuscate embedded malicious resources.
"""
id = "dbc72ac5-a004-45de-916d-e8aac82c4789"
license = "Elastic License v2"
name = "Payload Decoded via CertUtil"
os_list = ["windows"]
reference = ["https://lolbas-project.github.io/lolbas/Binaries/Certutil/"]
version = "1.0.5"

query = '''
process where event.action == "start" and
 (process.name : "certutil.exe" or process.pe.original_file_name == "CertUtil.exe") and
 process.args : ("-decode", "-decodehex") and
 not (user.id : "S-1-5-18" and process.args : "-decode" and
      process.parent.args : "?:\\ProgramData\\CentraStage\\AEMAgent\\Temp\\*.bat") and
 not (user.id : "S-1-5-18" and process.command_line : "certutil  -decode getSignatureInfo.base64 getSignatureInfo.ps1 ") and
 not process.command_line :
              ("certutil  -f -decode C:\\WINDOWS\\Temp\\csat\\csat_dwnldr.txt C:\\WINDOWS\\Temp\\csat\\csat_dwnldr.exe",
               "certutil  -decode \"c:\\HVworking\\checkSignature.base64\" \"c:\\HVworking\\checkSignature.bat\"")
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1027"
name = "Obfuscated Files or Information"
reference = "https://attack.mitre.org/techniques/T1027/"

[[threat.technique]]
id = "T1140"
name = "Deobfuscate/Decode Files or Information"
reference = "https://attack.mitre.org/techniques/T1140/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"