KQL_win_susp_certutil_command.txt

SecurityEvent | where EventID == "4688" | where CommandLine contains " -decode " or CommandLine contains " /decode " or CommandLine contains " -decodehex " or CommandLine contains " /decodehex " or CommandLine contains " -urlcache " or CommandLine contains " /urlcache " or CommandLine contains " -verifyctl " or CommandLine contains " /verifyctl " or CommandLine contains " -encode " or CommandLine contains " /encode " or CommandLine matches regex ".*certutil.* -URL.*" or CommandLine matches regex ".*certutil.* /URL.*" or CommandLine matches regex ".*certutil.* -ping.*" or CommandLine matches regex ".*certutil.* /ping.*"