Suspicious Certutil Decode

Follow the evidence. Build your hypothesis. Make the call.

● Investigation active

Follow the thread.

Each discovery leaves a trace.

Start with what you know

INITIAL ALERT

MKT-WS017

Suspicious Certutil Decode

UtcTime: 2026-09-14 09:42:17.381
Computer: MKT-WS017
User: CORP\jsantos
Image: C:\Windows\System32\certutil.exe
CommandLine: certutil.exe -decode C:\Users\jsantos\AppData\Local\Temp\Cache\media_cache.txt C:\Users\jsantos\AppData\Local\Temp\Cache\layout_preview.dat
ProcessId: 6420
ParentProcessId: 5988
IntegrityLevel: Medium

WHERE TO LOOK

Sysmon Event ID 1 · Windows Security 4688 · EDR Process Tree · SIEM

NEXT STEP

Suspicious Certutil Decode

Follow the thread.

Suspicious Certutil Decode

What do you investigate next?