certutil
- ID
- S0160
- Type
- Tool
- Associated names
- certutil.exe
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
certutil is a command-line utility that can be used to obtain certificate authority information and configure Certificate Services. [1]
Techniques used (4)
- T1105 Ingress Tool Transfer
- T1140 Deobfuscate/Decode Files or Information
- T1553.004 Install Root Certificate
- T1560.001 Archive via Utility
Groups using it (14)
- G0007 APT28
- G0010 Turla
- G0027 Threat Group-3390
- G0030 Lotus Blossom
- G0045 menuPass
- G0049 OilRig
- G0075 Rancor
- G0094 Kimsuky
- G0096 APT41
- G0126 Higaisa
- G1006 Earth Lusca
- G1016 FIN13
- G1017 Volt Typhoon
- G1051 Medusa Group