Loading story…
Windows certutil.exe, a legitimate certificate-management utility, has been documented as a living-off-the-land binary that attackers can abuse to download payloads and support follow-on compromise. Public LOLBAS and Hexacorn references describe certutil as both a command-line and GUI-capable LOLBin, highlighting how trusted native tooling can be repurposed to fetch remote content while blending into normal administrative activity.
Splunk Threat Research published a detection for certutil.exe abuse involving the -VerifyCtl and -f arguments, a pattern associated with ingress tool transfer under MITRE ATT&CK T1105, before later deprecating it in favor of a broader analytic for Windows file downloads via CertUtil. The detection relied on EDR and Windows process telemetry with full command-line logging, underscoring that monitoring certutil execution remains important because misuse can lead to malicious file retrieval, arbitrary code execution, data exfiltration, and wider system compromise.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Splunk Threat Research removed the detection "CertUtil Download With VerifyCtl and Split Arguments" from its content library and marked it deprecated in favor of "Windows File Download Via CertUtil." The removal is noted as part of content library version 5.8.0.
The LOLBAS project published an entry for Certutil, cataloging it as a legitimate Windows binary that can be abused for attacker activity.
A Hexacorn blog post documented certutil as "one more GUI lolbin," adding to public research on the utility's living-off-the-land abuse potential.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
research.splunk.com
Open sourcelolbas-project.github.io
Open sourcehexacorn.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers highlighted continued abuse of the Windows utility **`certutil.exe`** as a living-off-the-land tool for downloading malicious files from remote locations. The activity centers on use of the `-urlcache` and `-f` arguments, which allow attackers to retrieve payloads while blending into legitimate system activity, even though `certutil.exe` is intended for certificate management rather than file transfer. Splunk published detection guidance for identifying this behavior in Windows process and EDR telemetry, specifically looking for command-line patterns associated with remote downloads and payload staging. The analytic was later deprecated and replaced by **"Windows File Download Via CertUtil"**, but the underlying risk remains the same: successful abuse of `certutil.exe` can enable malware delivery, follow-on execution, system compromise, and unauthorized access, with defenders advised to tune detections using parent-child process relationships and related network activity.
Aug 12, 2026
Researchers reported that the **Veil#Drop** malware framework is using compromised websites, disguised scripts, PowerShell, and Google Blogspot pages to deliver the **PureLog Stealer** payload entirely in memory. The campaign relies on fileless execution, custom XOR encoding, and reflective loading of .NET assemblies to avoid writing artifacts to disk, while also abusing trusted Microsoft-signed binaries including **`InstallUtil.exe`**, **`RegSvcs.exe`**, and **`MSBuild.exe`** to blend malicious activity with legitimate Windows processes. PureLog Stealer is designed to harvest browser credentials, cookies, autofill data, cryptocurrency wallet information, and host details, with researchers warning that stolen session cookies may be reused to bypass MFA protections. The activity aligns with MITRE ATT&CK technique **`T1218.004`**, which documents how attackers can misuse **InstallUtil** for signed binary proxy execution by triggering installer components embedded in .NET binaries. Detection guidance has highlighted **InstallUtil** as a high-signal LOLBIN when it uses the **`/u`** uninstall switch and establishes remote network connections, behavior associated with malicious code download, arbitrary code execution, lateral movement, and possible data exfiltration. Splunk has since consolidated that monitoring into a broader analytic for **Windows InstallUtil remote network connections**, underscoring continued defender focus on this execution method.
Aug 12, 2026
Threat actors across espionage, cybercrime, and ransomware operations have repeatedly abused the native Windows binary **`rundll32.exe`** to execute malicious DLLs, stage payloads, evade defenses, and maintain persistence. MITRE ATT&CK catalogs the technique as **`T1218.011`** under *System Binary Proxy Execution*, citing use by groups and malware including **APT28**, **APT29**, **Sandworm**, **QakBot**, **IcedID**, **Bumblebee**, **Bad Rabbit**, **NotPetya**, **Egregor**, **MegaCortex**, and **Ragnar Locker**. The LOLBAS project likewise identifies `rundll32.exe` as a legitimate signed binary that can be repurposed to proxy malicious execution on Windows systems. One documented abuse path uses **`setupapi.dll`** or **`iesetupapi.dll`** with the **`LaunchINFSection`** function to bypass application control and trigger arbitrary script or payload execution, a method also described in public research on INF/SCT fetch-and-execute tradecraft for evasion and persistence. Splunk previously published a detection for suspicious `rundll32.exe` command lines tied to this behavior before replacing it with a broader analytic for Windows application whitelisting bypass attempts, underscoring continued defender focus on `rundll32.exe` as a high-risk living-off-the-land execution vector.
Aug 15, 2026