certutil as a downloader
Follow Sysmon events 1, 3, and 11 for one process: certutil started by a batch file, the host it fetched from, and the executable it wrote to a public folder.
Briefing
certutil.exe manages certificates, but its -urlcache -f options download any URL to a file. Because it is signed by Microsoft, it is a favourite way to fetch a second stage.
Sysmon event 1 is process creation, 3 is a network connection, and 11 is a file being created. The ProcessGuid ties all three to the same process.
WKS-0322 · Sysmon triage
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.