title: Suspicious Certreq Command to Download
id: 4480827a-9799-4232-b2c4-ccc6c4e9e12b
status: experimental
description: Detects a suspicious certreq execution taken from the LOLBAS examples, which can be abused to download (small) files
author: Christian Burkard
date: 2021/11/24
modified: 2022/06/13
references:
    - https://lolbas-project.github.io/lolbas/Binaries/Certreq/
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\certreq.exe'
        - OriginalFileName: 'CertReq.exe'
    selection_cli:
        CommandLine|contains|all:
            - ' -Post '
            - ' -config '
            - ' http'
            - ' C:\windows\win.ini '
    condition: all of selection*
fields:
    - CommandLine
    - ParentCommandLine
tags:
    - attack.command_and_control
    - attack.t1105
falsepositives:
    - Unlikely
level: high
