Suspicious CertReq Command for File Download
Detects the suspicious execution of `certreq.exe` with command-line arguments indicative of downloading a file. This behavior is often abused by attackers to download additional payloads or configuration files from a remote HTTP source. `Certreq.exe` is a legitimate Windows utility for certificate management but can be repurposed for malicious ingress tool transfer.
Sigma
