BadUSB LOLBIN execution via certutil (HID injection via Run dialog)

Hunt Hypothesis

This hunt targets adversaries leveraging BadUSB devices to inject malicious commands via the Windows Run dialog, utilizing legitimate binaries like certutil.exe and cmd.exe to download or decode payloads while evading traditional signature-based detection. Proactively hunting for this specific execution chain in Azure Sentinel is critical to identify early-stage lateral movement and data exfiltration attempts that exploit trusted system processes to bypass standard endpoint security controls.

KQL Query

let timeframe = 1d;
let LolbinFlags = dynamic([
    "urlcache",
    "-decode",
    "-decodehex",
    "verifyctl"
]);
DeviceProcessEvents
| where TimeGenerated >= ago(timeframe)
| where (
    FileName =~ "certutil.exe"
    and InitiatingProcessFileName =~ "explorer.exe"
    and ProcessCommandLine has_any (LolbinFlags)
)
or (
    FileName =~ "cmd.exe"
    and InitiatingProcessFileName =~ "explorer.exe"
    and ProcessCommandLine has "certutil"
    and ProcessCommandLine has_any (LolbinFlags)
)
| project
    TimeGenerated,
    DeviceName,
    AccountName,
    AccountDomain,
    FileName,
    ProcessCommandLine,
    InitiatingProcessFileName,
    InitiatingProcessCommandLine,
    ReportId
| sort by TimeGenerated desc

Analytic Rule Definition

id: d71e736b-f6e7-4acb-86f5-3696041868d7
name: BadUSB LOLBIN execution via certutil (HID injection via Run dialog)
description: |
  Identifies certutil.exe or cmd.exe spawned by explorer.exe with download or decode flags,
  consistent with BadUSB HID injection payloads that use WIN+R to invoke certutil as a
  living-off-the-land binary. The explorer.exe parent distinguishes Run dialog execution from
  scripted or interactive certutil use. Covers urlcache download and base64 decode paths.
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - DeviceProcessEvents
tactics:
  - InitialAccess
  - DefenseEvasion
  - CommandAndControl
relevantTechniques:
  - T1200
  - T1027
  - T1105
query: |
  let timeframe = 1d;
  let LolbinFlags = dynamic([
      "urlcache",
      "-decode",
      "-decodehex",
      "verifyctl"
  ]);
  DeviceProcessEvents
  | where TimeGenerated >= ago(timeframe)
  | where (
      FileName =~ "certutil.exe"
      and InitiatingProcessFileName =~ "explorer.exe"
      and ProcessCommandLine has_any (LolbinFlags)
  )
  or (
      FileName =~ "cmd.exe"
      and InitiatingProcessFileName =~ "explorer.exe"
      and ProcessCommandLine has "certutil"
      and ProcessCommandLine has_any (LolbinFlags)
  )
  | project
      TimeGenerated,
      DeviceName,
      AccountName,
      AccountDomain,
      FileName,
      ProcessCommandLine,
      InitiatingProcessFileName,
      InitiatingProcessCommandLine,
      ReportId
  | sort by TimeGenerated desc
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountName
      - identifier: NTDomain
        columnName: AccountDomain
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: DeviceName

Required Data Sources

MITRE ATT&CK Context

• Tactic: InitialAccess
• Tactic: DefenseEvasion
• Tactic: CommandAndControl
• Technique: T1200 — T1200
• Technique: T1027 — T1027
• Technique: T1105 — T1105

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/MultipleDataSources/BadUSBCertutilLOLBIN.yaml)

False Positive Guidance

Here are 4 specific false positive scenarios for the BadUSB LOLBIN execution via certutil detection rule, including suggested filters and exclusions:

• IT Helpdesk Remote Script Execution

  • Scenario: A helpdesk technician uses a standardized remote management tool (e.g., Microsoft Endpoint Configuration Manager (MECM) or Ivanti) to push a quick diagnostic script. The script triggers via the user’s explorer.exe session, launching cmd.exe which subsequently calls certutil -urlcache -split -f to download and unpack a compressed configuration package from an internal file server.
  • Suggested Filter: Exclude events where the parent process (explorer.exe) has a specific command line argument containing known remote management identifiers (e.g., /run:MECMTaskID or IvantiAgent) AND the target URL of the certutil command points to an internal domain suffix (e.g., .internal.corp.local).

• Automated Certificate Renewal via Scheduled Task

  • Scenario: An automated maintenance job runs during business hours on a workstation. A scheduled task triggers a PowerShell script that invokes explorer.exe to open a hidden dialog, which then executes certutil -decode to convert an encoded certificate file (.cer) into a readable format for a local group policy update or a browser trust store refresh.
  • Suggested Filter: Create an exclusion for cmd.exe processes spawned by explorer.exe where the command line contains the -decode flag AND the working directory is located within a standard administrative path (e.g., C:\ProgramData\CompanyScripts\CertMaintenance).

• Software Deployment via ClickOnce or Web-Based Installers

  • Scenario: An enterprise application deployment uses a web-based installer that relies on the Windows Runtime. When a user clicks