proc_creation_win_lolbin_susp_certreq_download.yml

title: Suspicious Certreq Command to Download
id: 4480827a-9799-4232-b2c4-ccc6c4e9e12b
status: test
description: Detects a suspicious certreq execution taken from the LOLBAS examples, which can be abused to download (small) files
references:
    - https://lolbas-project.github.io/lolbas/Binaries/Certreq/
author: Christian Burkard (Nextron Systems)
date: 2021/11/24
modified: 2022/06/13
tags:
    - attack.command_and_control
    - attack.t1105
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\certreq.exe'
        - OriginalFileName: 'CertReq.exe'
    selection_cli:
        CommandLine|contains|all:
            - ' -Post '
            - ' -config '
            - ' http'
            - ' C:\windows\win.ini '
    condition: all of selection*
fields:
    - CommandLine
    - ParentCommandLine
falsepositives:
    - Unlikely
level: high