BadUSB LOLBIN execution via certutil (HID injection via Run dialog)

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Content Index


Identifies certutil.exe or cmd.exe spawned by explorer.exe with download or decode flags, consistent with BadUSB HID injection payloads that use WIN+R to invoke certutil as a living-off-the-land binary. The explorer.exe parent distinguishes Run dialog execution from scripted or interactive certutil use. Covers urlcache download and base64 decode paths.

Attribute Value
Type Hunting Query
Solution GitHub Only
ID d71e736b-f6e7-4acb-86f5-3696041868d7
Tactics InitialAccess, DefenseEvasion, CommandAndControl
Techniques T1200, T1027, T1105
Required Connectors MicrosoftThreatProtection
Source [View on GitHub](https://github.com/Azure/Azure-Sentinel/blob/master/Hunting Queries/MultipleDataSources/BadUSBCertutilLOLBIN.yaml)

Tables Used

This content item queries data from the following tables:

Table Selection Criteria Transformations Ingestion API Lake-Only
DeviceProcessEvents InitiatingProcessFileName == "explorer.exe"
ProcessCommandLine has "certutil"
?

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Hunting Queries