Encoded payload file decoded by certutil or PowerShell

Siemphony@siemphonymediumT1027.013unverified

Matches the on-disk half of AN0237 — a command line that reads an encoded or encrypted file and converts it back to its original bytes. Two shapes are covered: certutil's -decode / -decodehex, which takes an encoded file in and writes a decoded file out, and a PowerShell invocation that combines a file-read call with a Base64 or symmetric-decryption call in the same line. The PowerShell branch requires both halves rather than either alone, because FromBase64String on its own is an inline-string decode belonging to T1027.010, whereas T1027.013 is specifically about an encoded *file*. The brief maps Security 4688 onto the process_creation category; this rule is written in the Sysmon process_creation vocabulary (Image, CommandLine), so a 4688 feed needs a field mapping — NewProcessName to Image, ParentProcessName to ParentImage — before it can match at all. 4688 also needs Audit Process Creation enabled plus the separate Include command line in process creation events policy; neither is on by default nor in the CIS baseline, and without the command-line policy every event arrives with an empty CommandLine and this rule silently matches nothing. AN0237's image_load and process_access legs, which cover the in-memory unpack that leaves no command-line trace, are not expressible as a single event and are not attempted here. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0087, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\certutil.exe" and (ProcessCommandLine contains "-decode" or ProcessCommandLine contains "/decode" or ProcessCommandLine contains "–decode" or ProcessCommandLine contains "—decode" or ProcessCommandLine contains "―decode" or ProcessCommandLine contains "-decodehex" or ProcessCommandLine contains "/decodehex" or ProcessCommandLine contains "–decodehex" or ProcessCommandLine contains "—decodehex" or ProcessCommandLine contains "―decodehex")) or (((FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe") and (ProcessCommandLine contains "FromBase64String" or ProcessCommandLine contains "FromBase64Transform" or ProcessCommandLine contains "CreateDecryptor" or ProcessCommandLine contains "GzipStream")) and (ProcessCommandLine contains "Get-Content" or ProcessCommandLine contains "ReadAllBytes" or ProcessCommandLine contains "ReadAllText" or ProcessCommandLine contains "OpenRead")))

Splunk · SPL

Run this as a search.

index=* ((Image="*\\certutil.exe" AND (CommandLine="*-decode*" OR CommandLine="*/decode*" OR CommandLine="*–decode*" OR CommandLine="*—decode*" OR CommandLine="*―decode*" OR CommandLine="*-decodehex*" OR CommandLine="*/decodehex*" OR CommandLine="*–decodehex*" OR CommandLine="*—decodehex*" OR CommandLine="*―decodehex*")) OR (((Image="*\\powershell.exe" OR Image="*\\pwsh.exe") AND (CommandLine="*FromBase64String*" OR CommandLine="*FromBase64Transform*" OR CommandLine="*CreateDecryptor*" OR CommandLine="*GzipStream*")) AND (CommandLine="*Get-Content*" OR CommandLine="*ReadAllBytes*" OR CommandLine="*ReadAllText*" OR CommandLine="*OpenRead*")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\certutil.exe" AND (TO_LOWER(process.command_line) LIKE "*-decode*" OR TO_LOWER(process.command_line) LIKE "*/decode*" OR TO_LOWER(process.command_line) LIKE "*–decode*" OR TO_LOWER(process.command_line) LIKE "*—decode*" OR TO_LOWER(process.command_line) LIKE "*―decode*" OR TO_LOWER(process.command_line) LIKE "*-decodehex*" OR TO_LOWER(process.command_line) LIKE "*/decodehex*" OR TO_LOWER(process.command_line) LIKE "*–decodehex*" OR TO_LOWER(process.command_line) LIKE "*—decodehex*" OR TO_LOWER(process.command_line) LIKE "*―decodehex*")) OR (((TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe") AND (TO_LOWER(process.command_line) LIKE "*frombase64string*" OR TO_LOWER(process.command_line) LIKE "*frombase64transform*" OR TO_LOWER(process.command_line) LIKE "*createdecryptor*" OR TO_LOWER(process.command_line) LIKE "*gzipstream*")) AND (TO_LOWER(process.command_line) LIKE "*get-content*" OR TO_LOWER(process.command_line) LIKE "*readallbytes*" OR TO_LOWER(process.command_line) LIKE "*readalltext*" OR TO_LOWER(process.command_line) LIKE "*openread*")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 2 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\certutil\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)(-decode|/decode|–decode|—decode|―decode|-decodehex|/decodehex|–decodehex|—decodehex|―decodehex)</field>    <description>Encoded payload file decoded by certutil or PowerShell (1/2)</description>    <mitre>      <id>T1027.013</id>    </mitre>  </rule>   <rule id="100001" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\pwsh\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)(FromBase64String|FromBase64Transform|CreateDecryptor|GzipStream)</field>    <field name="CommandLine" type="pcre2">(?i)(Get-Content|ReadAllBytes|ReadAllText|OpenRead)</field>    <description>Encoded payload file decoded by certutil or PowerShell (2/2)</description>    <mitre>      <id>T1027.013</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: obfuscated_payloads
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 2930f671-270e-44a8-823b-26eaf016f0a3

ATT&CKT1027.013

T1027.013Encrypted/Encoded File

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonobfuscated payloads

obfuscated payloadsAI draft — unreviewed

01 · What this rule detects

A command line that reads an encoded or encrypted file and converts it back to its original bytes. Two shapes are covered: certutil with its decode flags, and a PowerShell invocation that combines a file-read call with a Base64 or symmetric-decryption call in the same line. This is the on-disk half of MITRE's AN0237, which describes processes that load or decode encoded files and then execute or inject them.

02 · Telemetry you need

logsource: category: process_creation, product: windows, copied verbatim from the analytic. The rule is written in the Sysmon EventID 1 vocabulary (Image, CommandLine). The brief also maps Security 4688 onto this category, but 4688 carries NewProcessName and ParentProcessName, so that feed needs a field mapping before this rule can match at all. If you are on 4688, you also need Audit Process Creation enabled plus the separate Include command line in process creation events policy. Neither is on in a default install or in the CIS baseline, and without the command-line policy every event arrives with an empty CommandLine — every selection here tests that field, so the rule silently matches nothing while looking perfectly healthy.

03 · How the logic works

selection_certutil pairs Image|endswith: '\certutil.exe' with CommandLine|contains|windash on -decode and -decodehex. The windash modifier is what makes that leg survive the /decode, –decode and —decode variants an adversary can substitute freely; without it the leg is trivially bypassed by typing a forward slash. The PowerShell branch is deliberately a three-way AND. selection_ps_image pins the host to powershell.exe or pwsh.exe. selection_ps_decode looks for the conversion call — FromBase64String, FromBase64Transform, CreateDecryptor or GzipStream. selection_ps_file looks for the read — Get-Content, ReadAllBytes, ReadAllText or OpenRead. The condition is selection_certutil or (selection_ps_image and selection_ps_decode and selection_ps_file). Requiring both halves is the load-bearing decision. FromBase64String on its own is an inline-string decode, which belongs to T1027.010, not here. T1027.013 is specifically about an encoded file, so the file-read call is what makes the match the right technique rather than a near neighbour. MITRE's Image and CommandLine knobs are the tuning surface it names; the specific decoder names and API strings in the four lists are authored here. AN0237's image_load and process_access legs, which cover the in-memory unpack that leaves no command-line trace, are not expressible as a single Sigma event and are not attempted.

04 · Common false positives

certutil -decode has a documented, legitimate purpose: converting a Base64-armoured .cer or .pem certificate back to binary DER before importing it. That is the single most common reason the flag is ever typed. The PowerShell branch is hit by deployment tooling — Intune or SCCM remediation scripts, CI build agents, bootstrap scripts — that store a certificate, licence blob or config file Base64-encoded and read it back with Get-Content piped into FromBase64String. GzipStream after a file read is ordinary log processing with no obfuscation involved. Those benign shapes are indistinguishable on a single event, which is why the level is medium.

05 · Detection maturity

tier_1: Lowest tier. Machine-derived from ATT&CK v19.2, never executed against a log line, no measured hit rate. It stays there until someone runs it on real process-creation data and confirms both the field vocabulary and the volume.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Baseline first: pull a week of matches and sort by ParentImage and signing status of the parent. Suppress your management agents and build hosts by parent path, not by command line. For certutil, an exclusion on output paths under your PKI or certificate-staging directories removes most of the legitimate traffic. GzipStream is the weakest of the decode terms — drop it first if the PowerShell branch is unmanageable. MITRE's TimeWindow knob, for correlating decode with the execution that follows, needs a stateful platform; Sigma models no timeframe.

Declared by the author

Administrators and installer scripts using certutil -decode for its documented purpose, converting a Base64-armoured .cer or .pem certificate back to binary DER before importing it — the single most common legitimate reason that flag is ever typed.
Deployment and endpoint-management tooling — an Intune or SCCM remediation script, a CI build agent, or a bootstrap script — that stores a certificate, licence blob or configuration file Base64-encoded and reads it back with Get-Content piped into FromBase64String.
PowerShell modules and log-processing scripts that open a .gz artefact with GzipStream after reading it from disk, which satisfies the decode and file halves of the PowerShell branch without any obfuscation being involved.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1027.013, evaluated against their process_creation events.

Share this rule

/u/siemphony/2930f671-270e-44a8-823b-26eaf016f0a3

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Encoded payload file decoded by certutil or PowerShell

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it