Suspicious CertReq Command to Download

calendar Nov 6, 2025 · attack.command-and-control attack.t1105  ·
Share on: linkedin copy

Detects a suspicious CertReq execution downloading a file. This behavior is often used by attackers to download additional payloads or configuration files. Certreq is a built-in Windows utility used to request and retrieve certificates from a certification authority (CA). However, it can be abused by threat actors for malicious purposes.

Sigma rule (View on GitHub)

 1title: Suspicious CertReq Command to Download
 2id: 4480827a-9799-4232-b2c4-ccc6c4e9e12b
 3status: experimental
 4description: |
 5    Detects a suspicious CertReq execution downloading a file.
 6    This behavior is often used by attackers to download additional payloads or configuration files.
 7    Certreq is a built-in Windows utility used to request and retrieve certificates from a certification authority (CA). However, it can be abused by threat actors for malicious purposes.    
 8references:
 9    - https://lolbas-project.github.io/lolbas/Binaries/Certreq/
10author: Christian Burkard (Nextron Systems)
11date: 2021-11-24
12modified: 2025-10-29
13tags:
14    - attack.command-and-control
15    - attack.t1105
16logsource:
17    category: process_creation
18    product: windows
19detection:
20    selection_img:
21        - Image|endswith: '\certreq.exe'
22        - OriginalFileName: 'CertReq.exe'
23    selection_cli_flag_post:
24        CommandLine|contains|windash: '-Post'
25    selection_cli_flag_config:
26        CommandLine|contains|windash: '-config'
27    selection_cli_http:
28        CommandLine|contains: 'http'
29    condition: all of selection_*
30falsepositives:
31    - Unlikely
32level: high

References

  • Certreq on LOLBAS

    CertReq.exe is a living-of-the-land file containing unexpected functionality that can be abused by attackers; this page lists all its use cases.


    Read More

Related rules

to-top