certutil + bitsadmin → AV-friendly stager chain

§ Context

Assumed environment: foothold on a Windows endpoint where macro execution is blocked but the user can run cmd / batch scripts. AV detects raw `powershell -nop -w hidden iwr` patterns.

§ Steps

1. 01
   Initial shell via phishing payloadInitial Access

   T1078— Valid Accounts
2. 02
   Execute beaconExecution

   T1059— Command and Scripting Interpreter
3. 03
   C2 beacon establishedCommand and Control

   T1071— Application Layer Protocol
4. 04
   schtasks /create persistencePersistence

   W-SCHEDTASK-HIJACK— Scheduled Task Hijack
5. 05
   certutil -decode encoded blobCommand and Control

   LOL-CERTUTIL— certutil.exe Download / Decode
6. 06
   bitsadmin /transfer beacon.exeCommand and Control

   LOL-BITSADMIN— bitsadmin.exe Background Transfer

§ References

• T1078Valid Accounts
• T1059Command and Scripting Interpreter
• T1071Application Layer Protocol

§ Frequently asked

What is the "certutil + bitsadmin → AV-friendly stager chain" attack path?

Initial access dropped a tiny .bat. It uses certutil to decode a base64 blob and bitsadmin to fetch the real beacon, then schtasks for persistence. Every binary is signed Microsoft. It chains 6 steps drawn from real-world offensive-security techniques.

What starting position does this attack require?

The first step is Initial shell via phishing payload (T1078) — a initial access primitive. Assumed environment: foothold on a Windows endpoint where macro execution is blocked but the user can run cmd / batch scripts.

What is the final impact of this kill-chain?

The final step lands on bitsadmin /transfer beacon.exe (LOL-BITSADMIN), which falls under Command and Control. From here, an operator typically pivots into post-exploitation or maintains persistence.

How can defenders detect or prevent this attack?

Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers

• Shared techniques3

  USB drop in parking lot → HID payload → C2

  Drop branded-looking USB sticks near the target site. An employee plugs one in; a Rubber-Ducky-class HID device types a PowerShell payload that connects out to attacker C2.

• Shared techniques2

  io_uring UAF → modprobe_path overwrite → root

  Use an io_uring UAF to land arbitrary kernel write, repoint /proc/sys/kernel/modprobe to an attacker binary, then trigger a kernel auto-modprobe — runs the binary as root.

• Shared techniques2

  nf_tables UAF → kernel R/W → root

  CVE-2024-1086-class nf_tables UAF reachable from a user namespace. Win the race with userfaultfd to land an attacker object in the freed slot, build a kernel R/W primitive, overwrite the current task's cred struct.

• Shared techniques2

  BYOVD → kernel-level disable of EDR callbacks

  From local admin, load a signed-but-vulnerable driver. Use its kernel primitive to walk the EDR's PsSetCreateProcessNotifyRoutine entries and unlink them — EDR stops receiving events while still 'running'.

• Shared techniques2

  Build-system implant → signed supply-chain backdoor (SolarWinds-class)

  Compromise the target vendor's build server. A small implant rewrites a single source file at compile time — every official signed release downstream now ships the backdoor.

• Shared techniques2

  AMSI patch → in-memory .NET / PowerShell stager

  Patch AmsiScanBuffer in amsi.dll → return clean for any content. Subsequent PowerShell / Office VBA / .NET runtime calls emit attacker code without scanning.