Question

During a proactive threat hunt, an analyst reviews process telemetry and finds numerous invocations of certutil.exe and mshta.exe on multiple workstations. These binaries are signed, native Windows utilities that the EDR allowlist trusts, and no malware signatures fired. The analyst notes certutil.exe was used with arguments that decode a base64 file and download content from an external URL. What is the MOST appropriate conclusion and next step for the hunt?

Accepted Answer

This is likely living-off-the-land binary (LOLBin) abuse; pivot the hunt to build behavioral detections on anomalous command-line arguments and parent-child process relationships rather than relying on signatures.

Answer

Because the binaries are Microsoft-signed and allowlisted, the activity is benign administrative use and the hunt should be closed with no further action.

Answer

Immediately add certutil.exe and mshta.exe to the EDR block list to prevent all future execution, resolving the risk without further investigation.

Answer

Escalate to full disk imaging of every workstation before analyzing the command-line context, since any use of certutil.exe indicates active ransomware.