Skip to content

certutil

Software · ATTACK:enterprise:S0160

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S0160",
  "title": "certutil",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0160",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "tool--0a68f1f1-da74-4d28-8d9a-696c082706cc",
  "external_id": "S0160",
  "domain": "enterprise",
  "created": "2017-12-14T16:46:06.044Z",
  "modified": "2026-05-12T15:12:00.740Z",
  "version": "1.6",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "TechNet Certutil",
      "url": "https://technet.microsoft.com/library/cc732443.aspx"
    }
  ]
}

Explicit source assertions (20)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:S0160

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--00db4db6-fc7c-407b-81b5-11a3bdaac04f

ATTACK:enterprise:S0160 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f5462cb-ac39-49d1-848e-aefaaab321e3

LOLBAS Certutil · TechNet Certutil

ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:S0160

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--10af8211-36f6-4152-8221-c152407bd969

Accenture Hogfish April 2018 · FireEye APT10 Sept 2018 · Symantec Cicada November 2020

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:S0160

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c8634d8-21a1-46a5-a1fd-eaaff6eed7a6

Unit 42 Sofacy Feb 2018 · Cybersecurity Advisory GRU Brute Force Campaign July 2021

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:S0160

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--32dc76bb-6350-459f-b136-a1825886042c

Aryaka Kimsuky July 2025

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:S0160

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--36f14542-1dd2-4b2e-b69f-d7f38ea9800e

Symantec Waterbug Jun 2019

ATTACK:enterprise:C0040 → uses → ATTACK:enterprise:S0160

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--40b8b52b-319d-40a3-8c02-5e09b109b2ce

Google Cloud APT41 2024

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:S0160

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--431ec495-5f92-40e9-9955-58ca334ea3c8

FireEye APT34 Dec 2017 · Symantec Crambus OCT 2023

ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:S0160

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4437897d-7914-4eab-97e7-e5c6538afaf2

CISA Medusa Group Medusa Ransomware March 2025

ATTACK:enterprise:S0160 → uses → ATTACK:enterprise:T1553.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--542bb806-3e73-42f5-8a3e-86b498093f4b

Palo Alto Retefe

ATTACK:enterprise:S0160 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5918cee6-c2f1-41be-ab96-36f3d17e5293

Malwarebytes Targeted Attack against Saudi Arabia

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:S0160

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--614c18a5-2cee-48ac-898d-e1b85a91e44d

Trend Micro DRBControl February 2020

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:S0160

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6eac5e98-29dd-4dae-8375-b459b87f28c8

Malwarebytes Higaisa 2020 · PTSecurity Higaisa 2020

ATTACK:enterprise:S0160 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--73f5c564-53b1-48bc-8cab-32fa4a608672

TechNet Certutil · LOLBAS Certutil

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:S0160

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8a16836c-ad80-4c4f-8c4a-cfc639450a5a

Sygnia Elephant Beetle Jan 2022

ATTACK:enterprise:G1006 → uses → ATTACK:enterprise:S0160

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8b18d3d9-154d-435a-a174-d84ef5961ec8

TrendMicro EarthLusca 2022

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:S0160

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9cdb5a1a-a68f-4ee2-a807-ba4c0ae8e436

FireEye APT41 March 2020

ATTACK:enterprise:G0075 → uses → ATTACK:enterprise:S0160

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--be7a1288-68fd-4125-969b-bd123865c6b1

Rancor Unit42 June 2018

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:S0160

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e433aa4c-acb3-4283-a746-9ef79ebb81bf

CISA AA24-038A PRC Critical Infrastructure February 2024 · Secureworks BRONZE SILHOUETTE May 2023

ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:S0160

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e4afc655-77c8-4d76-b115-6da92455fd74

Symantec Bilbug 2022

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.