Decoding an encoded payload with a signed tool

lolbin_certutil_decode_payload

Writes a base64-encoded EICAR test file and decodes it in place with the platform's own signed decoder (certutil on Windows, base64 elsewhere), which is how encoded payloads are reconstituted on disk without a downloader.

Severity medium how bad it would be if it were real

Expected outcome Something should notice

Platforms 3 macOS, Linux, Windows

Isolation subprocess runs in its own process, so a kill is a measurement

What it needs before it will run

runs in --safe
Observation only. It runs even in the inert mode, because it changes nothing and sends nothing.

Gates are cumulative and none of them is implied by another: see the three gates for why they are separate decisions.

ATT&CK techniques it exercises

MITRE ATT&CK techniques this test maps to.
Technique	Name	Tactic	Across public reports
T1027	Obfuscated Files or Information	Defense Evasion	coverage statistics
T1140	Deobfuscate/Decode Files or Information	Defense Evasion	coverage statistics
T1218	System Binary Proxy Execution	Defense Evasion	coverage statistics

How often anything notices

Not enough data: fewer than 3 public reports have run this test, so no rate is published for it. Groups below that threshold are withheld everywhere on the site — with one or two contributors an average is one organisation's result with a percent sign after it.

Other living off the land tests

Other tests in the Living off the land category.
Test	What it does	Severity
Living-off-the-land download cradles lolbin_download_cradles	Fetches a two-byte file from the benchmark's own endpoint using each signed OS tool an attacker would use for it — certutil, bitsadmin, curl, wget, py…	high
Signed script-host execution lolbin_script_host_exec	Uses the signed script hosts — mshta, regsvr32 with scrobj, rundll32, wmic, cscript, osascript, perl, python — to execute an inert instruction that wr…	high

the whole catalogue this test in the list run it yourself

Catalogue generated from client 0.1.0. A test's behaviour can change between releases; this page describes the version named here.