Downloading Files with Certutil
Downloading additional files to the victim system using native OS binary.
Execution
Observations
Sysmon commandling logging is a good place to start for monitoring suspicious certutil.exe behaviour:
Last updated
