Tool: certutil

Description

[certutil](https://attack.mitre.org/software/S0160) is a command-line utility that can be used to obtain certificate authority information and configure Certificate Services. (Citation: TechNet Certutil)

External References

• mitre-attack
• TechNet Certutil

Techniques Used by This Tool

• T1105 — Ingress Tool Transfer
• T1140 — Deobfuscate/Decode Files or Information
• T1553.004 — Install Root Certificate
• T1560.001 — Archive via Utility

APT Groups Using This Tool

• OilRig
• Earth Lusca
• Turla
• APT28
• Volt Typhoon
• menuPass
• APT41
• FIN13
• Higaisa
• Threat Group-3390
• Rancor
• Lotus Blossom