🧰 certutil

The items that name it 6

• The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint
  writeupas classification.key entities2026-09-24
• UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations
  writeupas tools2026-08-20

  Living-off-the-land Windows utility abused to download malware payloads and scripts

• Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware
  writeupas tools2026-08-19

  Windows utility abused to install the actor's rogue root certificate authority (certutil -addstore -f ROOT)

• Socket: Operation Muck and Load
  writeupas tools2026-07-16

  Living-off-the-land Windows binary abused by the loader to decode api.db into L.ps1, avoiding a custom decoder.

• Plain Text Passwords: The Risks of Storing Them
  writeupas tools2026-07-06

  Windows built-in certificate utility abused by the attacker to enumerate (certutil -store My) and export (certutil -exportPFX) certificates including private keys.

• Sigma r2026-07-01 — 20 new detection rules
  repoas tools

  Windows certificate utility abused for downloads; rule updated with more file sharing domains