Uncommon Network Connection Initiated By Certutil.EXE

About the rule

Rule Type

Standard

Rule Description

An uncommon network connection initiated by Certutil.EXE, a legitimate Windows process, occurs when system administrators manage certificates such as certification authority, validation, configuration, copying and handling its backup and restore. Adversaries exploit the process to in order to download malware or drop additional payloads.

Severity

Trouble

Rule journey

Attack chain scenario

Initial access → Execution of Power-shell script → Defense Evasion → Command and control → Impact

Impact

• Certutil is used to decode the payload, which then launches a C2 RAT to communicate with the attacker over HTTP/S.
• HTTP request to the attacker's C2 hosting DNS.
• Data exfiltration through HTTP/S masking as regular web traffic.

Rule Requirement

Prerequisites

• Download and install Sysmon from Microsoft Sysinternals. Then, open a Command prompt with administrator privileges and create a Sysmon configuration which monitors the network connection using -

sysmon.exe -i [configfile.xml].

• Add network connection events to monitor in your configuration file using -

<Sysmon>
<EventFiltering>
<NetworkConnect onmatch="exclude"/>
<!-- This captures all network connection events -->
</EventFiltering>
</Sysmon>

• Create a new registry key "Microsoft-Windows-Sysmon/Network" in the directory "Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\".
• Allocate the registry value of Max Size to 200MB to ensure adequate storage for network logs, as they tend to be high volume.

Criteria

Detection

Execution Mode

realtime

Log Sources

Windows

MITRE ATT&CK

Command and Control : Ingress Tool Transfer (T1105)

Security Standards

Enabling this rule will help you meet the security standard's requirement listed below:

DE.CM-01: Networks and network services are monitored to find potentially adverse events.

Security administrators have to continuously monitor all the network and its services in real-time using SIEM tools. Enforce the policies on the web traffic to ensure the network security.

DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events.

Monitoring user activities and interactions with systems to track actions like logins, file access, or use of sensitive systems to identify suspicious behavior. By analyzing and correlating activity patterns in real time, it would lead to quickly detect anomalies and potential threats.

PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties

Security administrators ensure to draft and implement strict privilege permission for critical operations of certification and its processes. Leverage IAM and SIEM solutions to ensure access permission and authorizations and regular auditing practices.

Author

frack113, Florian Roth (Nextron Systems)

Future actions

Known False Positives

CertiUtil.exe process triggering a network connection during the Windows Update or Enterprise Certificate Management or during the certification validation could be a legitimate events.

Next Steps

When this rule is triggered, the following measures can be implemented:

1. Identification: Identify the event and check if the flagged incident is new or the existing one.
2. Analysis: Analyze the impact and extent of the incident to comprehend the severity of the attack using the Incident Workbench.
3. Response: Respond promptly by initiating an automated workflow to interrupt the network connections and kill or terminate the malicious process.
4. Reconfiguration: Update the network policies and port configurations and continuously monitor traffic trends in the network.

Mitigation