No PC version of GTA 6 exists - the 'download' is a WARDEN Stealer loader that raids Steam and crypto wallets. https://intel.threadlinqs.com/threat/TL-2026-5970?utm_source=bluesky #ThreatIntel #WARDEN #Clipper #certutil
November 13, 2026 at 3:29 PM
No PC version of GTA 6 exists - the 'download' is a WARDEN Stealer loader that raids Steam and crypto wallets. https://intel.threadlinqs.com/threat/TL-2026-5970?utm_source=bluesky #ThreatIntel #WARDEN #Clipper #certutil
Update: Microsoft removes the remaining eMudhra roots from 16 Nov (Windows, Edge, WebView2). Certificates that chain to them stop being trusted.
Do this: find and replace emSign certificates before 16 Nov.
Check: certutil -store Root
runbooklabhq.com/news/emudhra...
Do this: find and replace emSign certificates before 16 Nov.
Check: certutil -store Root
runbooklabhq.com/news/emudhra...
November 11, 2026 at 7:55 PM
Update: Microsoft removes the remaining eMudhra roots from 16 Nov (Windows, Edge, WebView2). Certificates that chain to them stop being trusted.
Do this: find and replace emSign certificates before 16 Nov.
Check: certutil -store Root
runbooklabhq.com/news/emudhra...
Do this: find and replace emSign certificates before 16 Nov.
Check: certutil -store Root
runbooklabhq.com/news/emudhra...
Attackers don't always bring tools. Windows has plenty.
certutil → Downloads files
mshta → Runs HTA scripts
rundll32 → Executes DLL code
regsvr32 → Loads remote scriptlets
All signed by Microsoft. The command line tells the story.
certutil → Downloads files
mshta → Runs HTA scripts
rundll32 → Executes DLL code
regsvr32 → Loads remote scriptlets
All signed by Microsoft. The command line tells the story.
November 7, 2026 at 1:37 PM
Attackers don't always bring tools. Windows has plenty.
certutil → Downloads files
mshta → Runs HTA scripts
rundll32 → Executes DLL code
regsvr32 → Loads remote scriptlets
All signed by Microsoft. The command line tells the story.
certutil → Downloads files
mshta → Runs HTA scripts
rundll32 → Executes DLL code
regsvr32 → Loads remote scriptlets
All signed by Microsoft. The command line tells the story.
Windows and Edge dropped 7 eMudhra certificates after 8 eMudhra CA keys were compromised.
Do this: get the trust-list update to disconnected devices; replace eMudhra-issued certs.
Check: certutil -store Root | findstr /i eMudhra
Source: MSRC blog, MC1529467
runbooklabhq.com/news/emudhra...
Do this: get the trust-list update to disconnected devices; replace eMudhra-issued certs.
Check: certutil -store Root | findstr /i eMudhra
Source: MSRC blog, MC1529467
runbooklabhq.com/news/emudhra...
Windows and Edge drop 7 eMudhra roots after CA key compromise
Windows and Edge stopped trusting seven eMudhra roots on 26 and 27 October 2026. Check that trust-list updates reach offline devices and replace certificates.
runbooklabhq.com
November 1, 2026 at 9:00 AM
Windows and Edge dropped 7 eMudhra certificates after 8 eMudhra CA keys were compromised.
Do this: get the trust-list update to disconnected devices; replace eMudhra-issued certs.
Check: certutil -store Root | findstr /i eMudhra
Source: MSRC blog, MC1529467
runbooklabhq.com/news/emudhra...
Do this: get the trust-list update to disconnected devices; replace eMudhra-issued certs.
Check: certutil -store Root | findstr /i eMudhra
Source: MSRC blog, MC1529467
runbooklabhq.com/news/emudhra...
being a developer means you can put stuff like this in your build process and nobody can stop you
October 27, 2026 at 7:04 PM
being a developer means you can put stuff like this in your build process and nobody can stop you
JSCeal hides its crypto stealer in compiled V8 bytecode and MITMs Binance traffic via a rogue root cert. https://intel.threadlinqs.com/threat/TL-2026-4165 #ThreatIntel #WEEVILPROXY #certutil #JSCEAL
October 22, 2026 at 5:16 PM
JSCeal hides its crypto stealer in compiled V8 bytecode and MITMs Binance traffic via a rogue root cert. https://intel.threadlinqs.com/threat/TL-2026-4165 #ThreatIntel #WEEVILPROXY #certutil #JSCEAL
"The privilege escalation tool the threat actors brought with them was written as a text file and then decoded using certutil into a binary file."
Read the full report:
https://
buff.ly/DL3KZOC
#DFIR #ThreatIntel
— from @TheDFIRReport (https://x.com/TheDFIRReport/status/2104307620576157993)
Read the full report:
https://
buff.ly/DL3KZOC
#DFIR #ThreatIntel
— from @TheDFIRReport (https://x.com/TheDFIRReport/status/2104307620576157993)
September 28, 2026 at 1:38 AM
"The privilege escalation tool the threat actors brought with them was written as a text file and then decoded using certutil into a binary file."
Read the full report:
https://
buff.ly/DL3KZOC
#DFIR #ThreatIntel
— from @TheDFIRReport (https://x.com/TheDFIRReport/status/2104307620576157993)
Read the full report:
https://
buff.ly/DL3KZOC
#DFIR #ThreatIntel
— from @TheDFIRReport (https://x.com/TheDFIRReport/status/2104307620576157993)
Dans ce guide, vous allez voir comment calculer et vérifier la somme de contrôle d’un fichier sous Windows 11/10 avec PowerShell, certutil, 7-Zip ou OpenHashTab, puis comparer les empreintes afin de contrôler un téléchargement ou une image ISO.
www.malekal.com/calculer-int...
www.malekal.com/calculer-int...
www.malekal.com
September 4, 2026 at 5:52 AM
Dans ce guide, vous allez voir comment calculer et vérifier la somme de contrôle d’un fichier sous Windows 11/10 avec PowerShell, certutil, 7-Zip ou OpenHashTab, puis comparer les empreintes afin de contrôler un téléchargement ou une image ISO.
www.malekal.com/calculer-int...
www.malekal.com/calculer-int...
Capture RAM first with WinPmem, into a raw image. Memory before disk, because memory dies the instant the machine changes state.
Then immediately hash it. SHA256 over the whole capture. certutil hashfile, one command, one fingerprint.
Then immediately hash it. SHA256 over the whole capture. certutil hashfile, one command, one fingerprint.
August 28, 2026 at 9:28 AM
Capture RAM first with WinPmem, into a raw image. Memory before disk, because memory dies the instant the machine changes state.
Then immediately hash it. SHA256 over the whole capture. certutil hashfile, one command, one fingerprint.
Then immediately hash it. SHA256 over the whole capture. certutil hashfile, one command, one fingerprint.
Windows trick I didn't know until today (h/t eversinc33), you can use certutil with the -error flag to look up a given error in hex or decimal form right in the command line. that is:
certutil.exe -error <number>
certutil.exe -error <number>
June 13, 2024 at 1:43 PM
Windows trick I didn't know until today (h/t eversinc33), you can use certutil with the -error flag to look up a given error in hex or decimal form right in the command line. that is:
certutil.exe -error <number>
certutil.exe -error <number>
iT4iNT SERVER What 45 Days of Watching Your Own Tools Will Tell You About Your Real Attack Surface VDS VPS Cloud #CyberSecurity #ThreatHunting #Malware #ITSecurity #IncidentResponse
What 45 Days of Watching Your Own Tools Will Tell You About Your Real Attack Surface
In Your Biggest Security Risk Isn't Malware — It's What You Already Trust, we made a simple argument: the most dangerous activity inside most organizations no longer looks like an attack. It looks like administration. PowerShell, WMIC, netsh, Certutil, MSBuild — the same trusted utilities your IT team uses every day are also the preferred toolkit of modern threat actors. Bitdefender's analysis
dlvr.it
May 15, 2026 at 1:34 PM
iT4iNT SERVER What 45 Days of Watching Your Own Tools Will Tell You About Your Real Attack Surface VDS VPS Cloud #CyberSecurity #ThreatHunting #Malware #ITSecurity #IncidentResponse
ShadowPad malware is being deployed via active exploitation of CVE-2025-59287 in WSUS.
Attackers gain system access, use PowerCat for shells, and install ShadowPad through certutil/curl with DLL side-loading using legitimate binaries.
#cybersecurity #malware #infosec #techsecurity #sysadmin
Attackers gain system access, use PowerCat for shells, and install ShadowPad through certutil/curl with DLL side-loading using legitimate binaries.
#cybersecurity #malware #infosec #techsecurity #sysadmin
November 24, 2025 at 11:18 AM
ShadowPad malware is being deployed via active exploitation of CVE-2025-59287 in WSUS.
Attackers gain system access, use PowerCat for shells, and install ShadowPad through certutil/curl with DLL side-loading using legitimate binaries.
#cybersecurity #malware #infosec #techsecurity #sysadmin
Attackers gain system access, use PowerCat for shells, and install ShadowPad through certutil/curl with DLL side-loading using legitimate binaries.
#cybersecurity #malware #infosec #techsecurity #sysadmin
Hackers don’t need fancy tooling anymore, the target system carries it for us.
We can "live off the land".
Your PowerShell. Your MSHTA. Your CERTUTIL.
Your tools, our commands.
#HackingTips
We can "live off the land".
Your PowerShell. Your MSHTA. Your CERTUTIL.
Your tools, our commands.
#HackingTips
March 3, 2026 at 10:03 PM
Hackers don’t need fancy tooling anymore, the target system carries it for us.
We can "live off the land".
Your PowerShell. Your MSHTA. Your CERTUTIL.
Your tools, our commands.
#HackingTips
We can "live off the land".
Your PowerShell. Your MSHTA. Your CERTUTIL.
Your tools, our commands.
#HackingTips
ファイルのハッシュ値は、ハッシュ関数というツールで調べられますよ。
Windowsの手順はこの記事が具体的です。
qiita.com/valpasucucci...
補足すると、ファイルからハッシュ値を調べるには、いくつかの計算方法（アルゴリズム）があります。
EmEditor公式が今回の件を受けて掲載したのは、SHA256によるハッシュ値だそうで。
なので、↑の記事で「ハッシュアルゴリズム」と言っている部分は、今回はSHA256を選べば良いです。
面倒ですけど、安全のためには、仕方ありません😢
（もっと楽な方法をご存知の方のご教示おまちしてます）
Windowsの手順はこの記事が具体的です。
qiita.com/valpasucucci...
補足すると、ファイルからハッシュ値を調べるには、いくつかの計算方法（アルゴリズム）があります。
EmEditor公式が今回の件を受けて掲載したのは、SHA256によるハッシュ値だそうで。
なので、↑の記事で「ハッシュアルゴリズム」と言っている部分は、今回はSHA256を選べば良いです。
面倒ですけど、安全のためには、仕方ありません😢
（もっと楽な方法をご存知の方のご教示おまちしてます）
Windows の標準機能でファイルのハッシュ値を取得する方法 - Qiita
概要 Windows の標準機能でファイルのハッシュ値を取得する方法について簡単に説明します。 方法 方法としては コマンド プロンプトにて certutil -hashfile コマンドを使用する Windows PowerShell にて Get-FileHas...
qiita.com
January 5, 2026 at 2:06 PM
ファイルのハッシュ値は、ハッシュ関数というツールで調べられますよ。
Windowsの手順はこの記事が具体的です。
qiita.com/valpasucucci...
補足すると、ファイルからハッシュ値を調べるには、いくつかの計算方法（アルゴリズム）があります。
EmEditor公式が今回の件を受けて掲載したのは、SHA256によるハッシュ値だそうで。
なので、↑の記事で「ハッシュアルゴリズム」と言っている部分は、今回はSHA256を選べば良いです。
面倒ですけど、安全のためには、仕方ありません😢
（もっと楽な方法をご存知の方のご教示おまちしてます）
Windowsの手順はこの記事が具体的です。
qiita.com/valpasucucci...
補足すると、ファイルからハッシュ値を調べるには、いくつかの計算方法（アルゴリズム）があります。
EmEditor公式が今回の件を受けて掲載したのは、SHA256によるハッシュ値だそうで。
なので、↑の記事で「ハッシュアルゴリズム」と言っている部分は、今回はSHA256を選べば良いです。
面倒ですけど、安全のためには、仕方ありません😢
（もっと楽な方法をご存知の方のご教示おまちしてます）
Well I made it through the meeting and she successfully ran a certutil command, so I think that's going to be fine, its just going to take a while bc the files are ginormous. But she seems to get how to do it now. Maybe all of those years teaching is still helping
March 20, 2025 at 2:55 PM
Well I made it through the meeting and she successfully ran a certutil command, so I think that's going to be fine, its just going to take a while bc the files are ginormous. But she seems to get how to do it now. Maybe all of those years teaching is still helping
Use certutil with select-string & regex to get file signing of driver files & also works for @microsoft.com exe files such as explorer.
@sysinternals.com sigcheck will do it too but you don't get that in OOBE
pastebin.com/BzBuRe7y
@sysinternals.com sigcheck will do it too but you don't get that in OOBE
pastebin.com/BzBuRe7y
December 31, 2024 at 10:35 AM
Use certutil with select-string & regex to get file signing of driver files & also works for @microsoft.com exe files such as explorer.
@sysinternals.com sigcheck will do it too but you don't get that in OOBE
pastebin.com/BzBuRe7y
@sysinternals.com sigcheck will do it too but you don't get that in OOBE
pastebin.com/BzBuRe7y
PowerShell Get-AuthenticodeSignature is great for checking the signing validity and signer of a file (eg check before running something downloaded in a script) but it doesn't show the vendor signing of driver files, only the
@Microsoft
signature.
Built in certutil can though
@Microsoft
signature.
Built in certutil can though
December 24, 2024 at 10:10 AM
PowerShell Get-AuthenticodeSignature is great for checking the signing validity and signer of a file (eg check before running something downloaded in a script) but it doesn't show the vendor signing of driver files, only the
@Microsoft
signature.
Built in certutil can though
@Microsoft
signature.
Built in certutil can though
Just today I was trying to look up certutil switches, and everything related to certificates was at the top. Even in quotes.
Verbatim has to be double specified.
Verbatim has to be double specified.
May 23, 2024 at 1:35 AM
Just today I was trying to look up certutil switches, and everything related to certificates was at the top. Even in quotes.
Verbatim has to be double specified.
Verbatim has to be double specified.
Letsdefend.io SOC163 — Suspicious Certutil.exe Usage (Event Id:113) - https://medium.com/@tahsinmelih.serbest/letsdefend-io-soc163-suspicious-certutil-exe-usage-event-id-113-e4b8ca1723be?source=rss------cybersecurity-5
Letsdefend.io SOC163 — Suspicious Certutil.exe Usage (Event Id:113)
<div><p><a href="https://medium.com/@tahsinmelih.serbest/letsdefend-io-soc163-suspicious-certutil-exe-usage-event-id-113-e4b8ca1723be?source=rss------cybersecurity-5"><img src="https://cdn-images-1.medium.com/max/2333/1*TCvuFV05dJ5Ad-Lmg2tSiA.png" width="2333" alt="1*TCvuFV05dJ5Ad-Lmg2tSiA.png"></a></p><p>Herkese merhaba, bugünkü yazımda letsdefend.io üzerinde 113 numaralı eventi çözümleyeceğim. İyi okumalar.</p><p><a href="https://medium.com/@tahsinmelih.serbest/letsdefend-io-soc163-suspicious-certutil-exe-usage-event-id-113-e4b8ca1723be?source=rss------cybersecurity-5">Continue reading on Medium »</a></p></div>
medium.com
July 31, 2023 at 3:52 PM
Letsdefend.io SOC163 — Suspicious Certutil.exe Usage (Event Id:113) - https://medium.com/@tahsinmelih.serbest/letsdefend-io-soc163-suspicious-certutil-exe-usage-event-id-113-e4b8ca1723be?source=rss------cybersecurity-5
Much respect to who ever developed certutil. The amount of crazy stuff I have seen it decode…
a man with glasses and a blue shirt is making a scared face .
Alt: a man with glasses and a blue shirt is making a scared face .
media.tenor.com
January 20, 2025 at 3:46 PM
Much respect to who ever developed certutil. The amount of crazy stuff I have seen it decode…
Security+ labs aren't required but dramatically improve your pass rate. Set up VirtualBox, install Kali Linux and a Windows VM. Practice port scanning with Nmap, packet capture with Wireshark, file hashing with certutil. Hands-on experience makes exam scenarios click instantly.
November 12, 2025 at 5:42 AM
Security+ labs aren't required but dramatically improve your pass rate. Set up VirtualBox, install Kali Linux and a Windows VM. Practice port scanning with Nmap, packet capture with Wireshark, file hashing with certutil. Hands-on experience makes exam scenarios click instantly.
🔌 certutil: CLI tool: certutil
📦 https://packages.debian.org/certutil
🔗 https://github.com/javimosch/supercli
#certutil #supercli
📦 https://packages.debian.org/certutil
🔗 https://github.com/javimosch/supercli
#certutil #supercli
August 17, 2026 at 11:44 PM
🔌 certutil: CLI tool: certutil
📦 https://packages.debian.org/certutil
🔗 https://github.com/javimosch/supercli
#certutil #supercli
📦 https://packages.debian.org/certutil
🔗 https://github.com/javimosch/supercli
#certutil #supercli
#RedTeam Techniques 🔥
💡 Living Off the Land (LotL):
• Use tools like PowerShell and CertUtil for stealthy data exfiltration or lateral movement.
🛡️ Pro Tip: Blend malicious activity with legitimate processes to avoid detection.
Adapt and innovate to simulate real-world threats! 🔐 #CyberSecurity
💡 Living Off the Land (LotL):
• Use tools like PowerShell and CertUtil for stealthy data exfiltration or lateral movement.
🛡️ Pro Tip: Blend malicious activity with legitimate processes to avoid detection.
Adapt and innovate to simulate real-world threats! 🔐 #CyberSecurity
November 21, 2024 at 11:57 AM
#RedTeam Techniques 🔥
💡 Living Off the Land (LotL):
• Use tools like PowerShell and CertUtil for stealthy data exfiltration or lateral movement.
🛡️ Pro Tip: Blend malicious activity with legitimate processes to avoid detection.
Adapt and innovate to simulate real-world threats! 🔐 #CyberSecurity
💡 Living Off the Land (LotL):
• Use tools like PowerShell and CertUtil for stealthy data exfiltration or lateral movement.
🛡️ Pro Tip: Blend malicious activity with legitimate processes to avoid detection.
Adapt and innovate to simulate real-world threats! 🔐 #CyberSecurity
Automated deletion of old computer certs from a Windows PKI based on data (expired > 5 years ago) and requester name, to find the right computers & skip user certs. Not a standard operation, but the needs arose, so we solved the challenge #certutil #PowerShell #MVPBuzz #PKI
May 14, 2025 at 4:56 PM
Automated deletion of old computer certs from a Windows PKI based on data (expired > 5 years ago) and requester name, to find the right computers & skip user certs. Not a standard operation, but the needs arose, so we solved the challenge #certutil #PowerShell #MVPBuzz #PKI