Loading story…
Security researchers highlighted continued abuse of the Windows utility certutil.exe as a living-off-the-land tool for downloading malicious files from remote locations. The activity centers on use of the -urlcache and -f arguments, which allow attackers to retrieve payloads while blending into legitimate system activity, even though certutil.exe is intended for certificate management rather than file transfer.
Splunk published detection guidance for identifying this behavior in Windows process and EDR telemetry, specifically looking for command-line patterns associated with remote downloads and payload staging. The analytic was later deprecated and replaced by "Windows File Download Via CertUtil", but the underlying risk remains the same: successful abuse of certutil.exe can enable malware delivery, follow-on execution, system compromise, and unauthorized access, with defenders advised to tune detections using parent-child process relationships and related network activity.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Splunk marked the detection "CertUtil Download With URLCache and Split Arguments" as removed and deprecated in favor of the replacement analytic "Windows File Download Via CertUtil." The entry states the detection was removed in content version 5.8.0 and is no longer maintained or supported.
A FireEye threat research post documented malicious use of certutil, including abuse of URL cache functionality to download payloads as a living-off-the-land technique.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
research.splunk.com
Open sourceresearch.splunk.com
Open sourceweb.archive.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Windows `certutil.exe`, a legitimate certificate-management utility, has been documented as a **living-off-the-land binary** that attackers can abuse to download payloads and support follow-on compromise. Public LOLBAS and Hexacorn references describe `certutil` as both a command-line and GUI-capable LOLBin, highlighting how trusted native tooling can be repurposed to fetch remote content while blending into normal administrative activity. Splunk Threat Research published a detection for `certutil.exe` abuse involving the `-VerifyCtl` and `-f` arguments, a pattern associated with **ingress tool transfer** under MITRE ATT&CK `T1105`, before later deprecating it in favor of a broader analytic for Windows file downloads via CertUtil. The detection relied on EDR and Windows process telemetry with full command-line logging, underscoring that monitoring `certutil` execution remains important because misuse can lead to malicious file retrieval, arbitrary code execution, data exfiltration, and wider system compromise.
Aug 12, 2026
Researchers reported that the **Veil#Drop** malware framework is using compromised websites, disguised scripts, PowerShell, and Google Blogspot pages to deliver the **PureLog Stealer** payload entirely in memory. The campaign relies on fileless execution, custom XOR encoding, and reflective loading of .NET assemblies to avoid writing artifacts to disk, while also abusing trusted Microsoft-signed binaries including **`InstallUtil.exe`**, **`RegSvcs.exe`**, and **`MSBuild.exe`** to blend malicious activity with legitimate Windows processes. PureLog Stealer is designed to harvest browser credentials, cookies, autofill data, cryptocurrency wallet information, and host details, with researchers warning that stolen session cookies may be reused to bypass MFA protections. The activity aligns with MITRE ATT&CK technique **`T1218.004`**, which documents how attackers can misuse **InstallUtil** for signed binary proxy execution by triggering installer components embedded in .NET binaries. Detection guidance has highlighted **InstallUtil** as a high-signal LOLBIN when it uses the **`/u`** uninstall switch and establishes remote network connections, behavior associated with malicious code download, arbitrary code execution, lateral movement, and possible data exfiltration. Splunk has since consolidated that monitoring into a broader analytic for **Windows InstallUtil remote network connections**, underscoring continued defender focus on this execution method.
Aug 12, 2026
Security reporting and vendor guidance highlight continued abuse of PowerShell's **`DownloadString`** capability to retrieve and execute remote payloads, a technique repeatedly seen in real-world intrusions. Microsoft documents the .NET `System.Net.WebClient.DownloadString` method as a way to fetch remote content, while Splunk previously published a detection analytic for PowerShell processes invoking `DownloadString`, warning that the behavior can enable arbitrary code download, execution, unauthorized access, and data exfiltration. The detection mapped the activity to **MITRE ATT&CK** techniques `T1059.001` and `T1105` before being replaced with broader file-download coverage. Case studies cited in the references show the technique appearing in multi-stage attacks involving commodity malware and post-exploitation frameworks. Malwarebytes documented the **LazyScripter** actor using PowerShell-heavy tradecraft in campaigns tied to tools including **Empire** and **Double RAT**, while DFIR reporting described an intrusion chain in which an **IcedID** infection escalated into **Nokoyawa ransomware** deployment. Together, the references show `DownloadString` remaining a common execution and payload-delivery mechanism across malware operations and hands-on-keyboard ransomware activity.
Aug 12, 2026