A technique that abuses the Windows certutil utility to retrieve, decode, or drop files during an attack. Because the tool is legitimate system software, its use can blend into normal activity, allowing attackers to stage payloads with less immediate suspicion from users or some security controls.
What Certutil Delivery Does
Certutil delivery is a living-off-the-land technique in which an attacker uses the Windows certutil utility to fetch, decode, or stage files. The key issue is not that certutil is malicious, but that it is trusted software already present on many systems, which makes the activity easier to hide among ordinary administrative or troubleshooting use.
Why Attackers Use Certutil Delivery
Attackers favor certutil because it can reduce friction at multiple steps of an intrusion. It may help move payloads onto a host, transform encoded content into usable binaries or scripts, or support simple staging when other download paths are blocked. That makes it useful in initial access, follow-on execution, and hands-on-keyboard operations where speed and reliability matter.
Because the utility is legitimate, defenders may see command lines that look mundane unless they inspect the full parent-child process chain, command arguments, file write activity, and the surrounding execution context. The same behavior that makes certutil convenient for administrators also makes it attractive for abuse.
How Certutil Delivery Blends Into Normal Activity
Certutil is part of the broader class of dual-use Windows tools that can be repurposed for attacker tradecraft. Its legitimacy can create a visibility gap when security teams rely too heavily on simple allowlists or on process reputation alone. A signed Microsoft binary does not guarantee the action is benign; the important question is whether the command, source, and resulting file behavior fit the expected operational pattern.
This is why certutil delivery is best understood as a detection problem as much as an execution technique. The same binary may be used for certificate operations in one context and for file transfer or decoding in another. Context, not the utility name by itself, determines whether the activity is normal administration or suspicious staging.
For a broader view of how these dual-use utilities fit into attacker tradecraft, see Living off the Land Guide.
Detection, Hardening, and Response Priorities
Defending against certutil delivery depends on watching for unusual command-line use, unexpected outbound retrieval, and decode or write behavior that is inconsistent with the host’s role. Security teams should correlate process creation, file creation, network activity, and subsequent execution so they can distinguish administrative use from staging activity. Where possible, application control and command-line auditing reduce the room for abuse.
After suspected use, review the files written to disk, the execution chain that launched certutil, and any later processes that consumed the dropped content. If the technique was used to stage malware, the defensive response should extend beyond the initial binary to any downloaded payloads, scheduled tasks, persistence artifacts, and associated credentials or sessions that may have been used during the intrusion.
Threat hunters can map this activity to known adversary patterns in MITRE ATT&CK Enterprise Matrix and use that model to guide searches for living-off-the-land execution and follow-on compromise.
When Certutil Delivery Becomes a Real Security Problem
The technique becomes especially dangerous when it is combined with valid access, weak monitoring, and permissive execution policy. In that situation, certutil can serve as a quiet staging mechanism that helps an intruder move from initial foothold to payload deployment without immediately triggering signature-based controls.
Its practical risk is less about the utility itself and more about the trust defenders place in default system tools. If a control strategy assumes that built-in binaries are inherently safe, an attacker can use them to bypass simple blocking logic, delay detection, and increase the time available for lateral movement or persistence.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, OWASP ASVS and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1218 — Signed Binary Proxy Execution | Certutil delivery is a classic signed-binary abuse pattern that fits ATT&CK living-off-the-land tradecraft. |
| Recommendation — Map certutil activity to signed binary proxy execution and hunt for suspicious command-line staging patterns. | ||
| CIS Controls v8 | CIS-2 — Inventory and Control of Software Assets | Trusted built-in utilities need asset visibility to separate normal admin use from abuse. |
| Recommendation — Inventory certutil use across endpoints and flag hosts where the tool appears in unexpected execution chains. | ||
| OWASP ASVS | V16 — Security Logging and Error Handling | Detection of dual-use utility abuse depends on detailed logging of process, file, and execution context. |
| Recommendation — Log process creation and command lines so suspicious certutil staging can be investigated quickly. | ||
| NIST SP 800-53 Rev 5 | SI-4 — System Monitoring | Monitoring system tool execution and file activity is central to spotting abused certutil behavior. |
| CM-7 — Least Functionality | Restricting unnecessary utilities and their behaviors reduces the abuse surface for living-off-the-land tradecraft. | |
| Recommendation — Correlate command execution, file writes, and network events to detect malicious certutil use. Limit unnecessary certutil capabilities where operationally feasible and reduce exposed execution paths. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org