Certreq HTTP POST Abuse for File Transfer

The Windows Certreq utility is a command-line tool used for certificate requests and management. However, it can be abused by attackers to download files or upload data to remote URLs using HTTP POST requests. This technique can be employed for various malicious purposes, including command and control, defense evasion, and exfiltration. This activity is typically seen following an initial compromise, where Certreq is used as a Living-off-the-Land Binary (LOLBin) to avoid detection and blend in with legitimate system activity. The abuse of Certreq.exe with the -Post argument is a red flag that warrants investigation.

Attack Chain

1. An attacker gains initial access to a Windows system through a vulnerability or compromised credentials.
2. The attacker executes certreq.exe with the -Post argument to initiate an HTTP POST request.
3. The certreq.exe command is used to download a malicious payload from a remote server.
4. The downloaded payload is saved to disk, potentially bypassing some endpoint detection systems due to the use of a legitimate system binary.
5. The attacker executes the downloaded payload, establishing a reverse shell or performing other malicious activities.
6. The attacker uses the same certreq.exe -Post technique to upload collected data to a command and control server.
7. The attacker leverages the established C2 channel to move laterally within the network.
8. The attacker exfiltrates sensitive data using certreq.exe -Post over web protocols to an external server.

Impact

Successful exploitation can lead to the compromise of sensitive data, the establishment of persistent backdoors, and further propagation within the network. The use of a legitimate system binary like certreq.exe makes detection more challenging, allowing attackers to operate undetected for extended periods. While the specific number of victims is unknown, organizations that do not monitor for LOLBin abuse are at higher risk.

Recommendation

• Deploy the Sigma rule "Detect Certreq HTTP POST Request" to detect the execution of certreq.exe with the -Post argument (see below).
• Monitor process creation events for the execution of certreq.exe, focusing on command-line arguments and parent processes.
• Implement network monitoring to detect suspicious outbound HTTP POST requests originating from certreq.exe.
• Investigate any instances of certreq.exe making network connections to unusual or suspicious domains.
• Enable Windows Security Event Logging and Sysmon to capture detailed process execution and network connection information.