SOC163 EventID:113 — Suspicious Certutil.exe Usage — letsdefend.io

SOC163 EventID:113 — Suspicious Certutil.exe Usage — letsdefend.io

First let’s have a look at the provided alert report.

EventID              : 113
Event Time           : Mar, 01, 2022, 11:06 AM
Rule                 : SOC163 - Suspicious Certutil.exe Usage
Level                : Security Analyst
Hostname             : EricProd
IP Address           : 172.16.17.22
Related Binary       : certutil.exe
Binary Path          : C:/Windows/System32/certutil.exe
Command Line         : certutil.exe -urlcache -split -f https://nmap.org/dist/nmap-7.92-win32.zip nmap.zip
Alert Trigger Reason : -f parameter with certutil.exe
EDR Action           : Allowed

This event appears to …

blue team incident response letsdefendio soc