Detection rules › Splunk

Certutil Obfuscate_Encode Files (Windows Event Log)

Group by
_time, host
Source
github.com/anvilogic-forge/armory

Certutil can be used to encode files to evade defensive measures

MITRE ATT&CK coverage

TacticTechniques
Stealth
Command & Control

References

Telemetry coverage

Rule body

id: '6158.6685'
title: Certutil Obfuscate_Encode Files
description: 'Certutil can be used to encode files to evade defensive measures. --
  Threat Actor Association: APT29/Nobelium/Cozy Bear, Arid Viper/APT C-23, BlackTech
  - Software Association: Conti'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("certutil" (TERM(-encode) OR TERM(-encodehex)))
  OR (TERM(-encode) OR TERM(-encodehex)) | table _time, host, user, signature_id,
  process, process_*, parent_* | bin span=1s | stats values(*) as * by _time, host
  | where match(process, "(?i)-encode") '
techniques:
- command-and-control:data encoding
- defense-evasion:obfuscated files or information
technique_id: 
- T1027
- T1132
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://lolbas-project.github.io/lolbas/Binaries/Certutil/

Stages and Predicates

Stage 1: search

`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process) ("certutil" (TERM(-encode) OR TERM(-encodehex))) OR (TERM(-encode) OR TERM(-encodehex))

Stage 2: table

| table _time, host, user, signature_id, process, process_*, parent_*

Stage 3: bucket

| bin span=1s

Stage 4: stats

| stats values(*) as * by _time, host

Stage 5: where

| where match(process, "(?i)-encode")

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
EventCodeeq
  • 4688 corpus 317 (splunk 283, kusto 33, elastic 1)
field:"EventID" kind:eq value:"4688"
processregex_match
  • "(?i)-encode" corpus 2 (splunk 2)
field:"CommandLine" kind:regex_match

Search terms

These SPL tokens match against raw event text.

StageTerm
1"<EventID>4688<"
1"certutil"
1"-encode"
1"-encodehex"
1"-encode"
1"-encodehex"