Certutil Decoding After DNS Lookup Chain (LOLBin DNS Staging)

11 DNS Certutil LOL Bin Chain

Query

let NslookupEvents =
    SecurityEvent
    | where TimeGenerated > ago(1h)
    | where EventID == 4688
    | where Process =~ "nslookup.exe"
    | summarize
        NslookupCount = count(),
        NslookupTime  = min(TimeGenerated),
        NslookupCmds  = make_set(CommandLine, 5)
      by Computer, Account;
let CertutilEvents =
    SecurityEvent
    | where TimeGenerated > ago(1h)
    | where EventID == 4688
    | where Process =~ "certutil.exe"
    | where CommandLine has_any ("-decode", "-decodehex", "-urlcache", "-f")
    | summarize
        CertutilCount = count(),
        CertutilTime  = min(TimeGenerated),
        CertutilCmds  = make_set(CommandLine, 5)
      by Computer, Account;
NslookupEvents
| join kind=inner CertutilEvents on Computer, Account
| where CertutilTime > NslookupTime
    and (CertutilTime - NslookupTime) < 10m
| where NslookupCount >= 10
| project
    Computer,
    Account,
    NslookupCount,
    NslookupTime,
    CertutilTime,
    NslookupCmds,
    CertutilCmds,
    TimeDelta = CertutilTime - NslookupTime

Explanation

This query is designed to detect a specific type of cyber attack that uses trusted Windows tools to execute malicious activities without raising immediate suspicion. Here's a simplified breakdown:

Purpose: The query identifies a technique where attackers use two legitimate Windows tools, nslookup.exe and certutil.exe, to download and assemble malicious software. This method is known as a "Living-off-the-Land Binary" (LOLBin) attack, which can bypass security measures like application whitelisting.
Attack Chain:
- Step 1: nslookup.exe is used to make multiple DNS queries to retrieve small pieces of data encoded in base64 or hex format.
- Step 2: certutil.exe is then used to decode these pieces and reassemble them into an executable file.
Detection Criteria:
- The query looks for a burst of nslookup.exe activity (at least 10 calls) from the same computer and user account within a 10-minute window before certutil.exe is executed.
- It specifically checks for certutil.exe commands that involve decoding operations.
Severity and Context:
- The severity of this detection is marked as high because it indicates a sophisticated attack method.
- The query is run every 15 minutes and looks back over the past hour to identify potential threats.
Technical Details:
- The query uses data from security events, focusing on process creation events (EventID 4688).
- It correlates nslookup.exe and certutil.exe activities by matching them on the same computer and user account.
Output:
- If the conditions are met, the query generates an alert with details about the computer and account involved, the number of nslookup.exe calls, and the commands used.
Additional Information:
- The query includes mappings to identify the host and account entities involved in the potential attack.
- It provides a custom alert message format to clearly describe the detected activity.

Overall, this query helps security teams identify and respond to potential threats that use trusted tools in a malicious way, leveraging DNS for payload delivery and assembly.

Details

David Alonso

Released: July 28, 2026

Tables

SecurityEvent

Keywords

SecurityEventsSecurityEventComputerAccountHostName

Operators

letwhereagosummarizecountminmake_setbyjoinkindonandprojecthas_any=~

Severity

High

Tactics

ExecutionDefenseEvasionCommandAndControl

MITRE Techniques

T1218.003 T1027 T1071.004

Frequency: 15m

Period: 1h

Actions

GitHub

KQL Search