Detects the execution of certutil with certain flags that allow the utility to download files.
Read the full analysis on IntelFusions