Step-by-step methodology for building cross-platform Sigma detection signatures to flag Certutil, Bitsadmin, and Mshta exploitation.

### The Challenge of LOLBins

Living-off-the-Land Binaries (LOLBins) are legitimate system utilities pre-installed on operating systems. Because administrative scripts regularly invoke these tools, traditional antivirus often overlooks their malicious usage.

Writing a Sigma Rule for Certutil File Ingress

The `certutil.exe` utility is designed for certificate management, but adversaries misuse parameters like `-urlcache -split -f` to download remote malware binaries.

Here is the standardized Sigma rule:

title: Certutil Remote File Download Activity
id: 9a5b3c4d-1234-5678-9abc-def012345678
status: production
description: Detects execution of certutil.exe with arguments typically used to download remote files.
references:
    - https://lolbas-project.github.io/lolbas/Binaries/Certutil/
author: Binod Rawat
date: 2024/04/10
tags:
    - attack.command_and_control
    - attack.t1105
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: 'certutil.exe'
        CommandLine|contains:
            - '-urlcache'
            - '/urlcache'
            - '-verifyctl'
    condition: selection
falsepositives:
    - Legitimate administrative scripts updating CRLs.
level: high

Converting Sigma to Native SIEM Formats

Using `sigmac`, you can easily compile this rule into Splunk SPL or Elastic Lucene queries:

# Convert to Splunk SPL
sigma convert -t splunk -p sysmon certutil_download.yml

By maintaining vendor-agnostic Sigma rules in Git, defensive teams ensure rapid portability across any SIEM stack!