Suspicious Certreq Command to Download
Detects a suspicious certreq execution taken from the LOLBAS examples, which can be abused to download (small) files
Sigma rule (View on GitHub)
1title: Suspicious Certreq Command to Download
2id: 4480827a-9799-4232-b2c4-ccc6c4e9e12b
3status: test
4description: Detects a suspicious certreq execution taken from the LOLBAS examples, which can be abused to download (small) files
5references:
6 - https://lolbas-project.github.io/lolbas/Binaries/Certreq/
7author: Christian Burkard (Nextron Systems)
8date: 2021/11/24
9modified: 2022/06/13
10tags:
11 - attack.command_and_control
12 - attack.t1105
13logsource:
14 category: process_creation
15 product: windows
16detection:
17 selection_img:
18 - Image|endswith: '\certreq.exe'
19 - OriginalFileName: 'CertReq.exe'
20 selection_cli:
21 CommandLine|contains|all:
22 - ' -Post '
23 - ' -config '
24 - ' http'
25 - ' C:\windows\win.ini '
26 condition: all of selection*
27fields:
28 - CommandLine
29 - ParentCommandLine
30falsepositives:
31 - Unlikely
32level: high
References
Related rules
- Curl Usage on Linux
- Finger.exe Suspicious Invocation
- Password Protected ZIP File Opened (Suspicious Filenames)
- Potential Download/Upload Activity Using Type Command
- PrintBrm ZIP Creation of Extraction