Certutil Execution via WinrsHost

X__Junior

Detects the execution of certutil from WinrsHost.exe, which may indicate the use of Windows Remote Shell (WinRS) for malicious purposes. This combination is often seen in lateral movement and defense evasion techniques, where attackers leverage remote execution to run malicious commands such as certificate manipulation or payload retrieval.

2025-02-24 00:00:00

None

2d3181ad-74e5-4b80-84e6-8c574fc3b52c

attack.defense-evasion

Nextron Sigma feed only (private)