huntrule

Windows certreq.exe CertReq -Post Download Execution

Flags certreq.exe executions using -Post -config and HTTP content retrieval indicators.

FreeUnreviewedSigmahighv1
title: Windows certreq.exe CertReq -Post Download Execution
id: 4d12bfd1-8edc-4b0e-86b5-d647057d13e5
status: experimental
description: This rule identifies suspicious execution of certreq.exe where the command line includes both -Post and -config and contains the string "http". It catches attempts to have certreq download or submit additional content, a behavior commonly abused to retrieve attacker-controlled payloads or configuration. The detection relies on Windows process creation telemetry with Image/OriginalFileName and CommandLine fields.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Certreq/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_certreq_download.yml
author: Christian Burkard (Nextron Systems), Huntrule Team
date: 2021-11-24
modified: 2025-10-29
tags:
  - attack.command-and-control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \certreq.exe
    - OriginalFileName: CertReq.exe
  selection_cli_flag_post:
    CommandLine|contains|windash: -Post
  selection_cli_flag_config:
    CommandLine|contains|windash: -config
  selection_cli_http:
    CommandLine|contains: http
  condition: all of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 4480827a-9799-4232-b2c4-ccc6c4e9e12b
    type: derived

What it detects

This rule identifies suspicious execution of certreq.exe where the command line includes both -Post and -config and contains the string "http". It catches attempts to have certreq download or submit additional content, a behavior commonly abused to retrieve attacker-controlled payloads or configuration. The detection relies on Windows process creation telemetry with Image/OriginalFileName and CommandLine fields.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.