Windows CertReq -Post Download Attempt via HTTP
Flags certreq.exe executions using -Post -config and HTTP content retrieval indicators.
- Product
- windows
- Category
- process_creation
- Author
- Christian Burkard (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-11-24
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
Identifies execution of certreq.exe where the command line includes the -Post option and a -config argument, along with an HTTP URL. This pattern can be used to retrieve additional content or configuration through certreq, which is a legitimate Windows certificate utility that attackers may repurpose for command-and-control style payload retrieval. The detection relies on Windows process creation telemetry with command-line arguments and process image/original filename metadata.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows CertReq -Post Download Attempt via HTTP
id: 4d12bfd1-8edc-4b0e-86b5-d647057d13e5
status: experimental
description: Identifies execution of certreq.exe where the command line includes the -Post option and a -config argument, along with an HTTP URL. This pattern can be used to retrieve additional content or configuration through certreq, which is a legitimate Windows certificate utility that attackers may repurpose for command-and-control style payload retrieval. The detection relies on Windows process creation telemetry with command-line arguments and process image/original filename metadata.
references:
- https://lolbas-project.github.io/lolbas/Binaries/Certreq/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_certreq_download.yml
author: Christian Burkard (Nextron Systems), Huntrule Team
date: 2021-11-24
modified: 2025-10-29
tags:
- attack.command-and-control
- attack.t1105
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \certreq.exe
- OriginalFileName: CertReq.exe
selection_cli_flag_post:
CommandLine|contains|windash: -Post
selection_cli_flag_config:
CommandLine|contains|windash: -config
selection_cli_http:
CommandLine|contains: http
condition: all of selection_*
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 4480827a-9799-4232-b2c4-ccc6c4e9e12b
type: derived