Suspicious CertReq Command to Download

Title: Suspicious CertReq Command to Download
Status: experimental
Description:Detects a suspicious CertReq execution downloading a file. This behavior is often used by attackers to download additional payloads or configuration files. Certreq is a built-in Windows utility used to request and retrieve certificates from a certification authority (CA). However, it can be abused by threat actors for malicious purposes.
References:
  -https://lolbas-project.github.io/lolbas/Binaries/Certreq/
Author: Christian Burkard (Nextron Systems)
Date: 2021-11-24
modified:2025-10-29
Tags:

• -'attack.command-and-control'
• -'attack.t1105'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\certreq.exe' OriginalFileName:'CertReq.exe'   selection_cli_flag_post:
    CommandLine|contains|windash: '-Post'
  selection_cli_flag_config:
    CommandLine|contains|windash: '-config'
  selection_cli_http:
    CommandLine|contains: 'http'
  condition:all of selection_*
Falsepositives:
  -Unlikely
Level: high