Skip to content
Threat Feed
Subscribe

Tag

Certreq

2 briefs RSS
medium advisory

Potential Abuse of Certreq for File Transfer via HTTP POST

Adversaries may abuse the Windows Certreq utility to download files or upload data to a remote URL by making an HTTP POST request, potentially for command and control or exfiltration, which can be detected by monitoring process execution events.

Microsoft Defender XDR +2 lolbin command-and-control exfiltration certreq
2r 4t
medium advisory

Certreq HTTP POST Abuse for File Transfer

Adversaries may abuse the Windows Certreq utility to download files or upload data to a remote URL by making an HTTP POST request, potentially for command and control, defense evasion, or exfiltration.

lolbin certreq command-and-control defense-evasion exfiltration
2r 4t