Suspicious Certreq Command to Download

Google SecOps@GoogleSecOps

•updated Jun 6, 2025•0•0•0

Detects a suspicious certreq execution taken from the LOLBAS examples, which can be abused to download (small) files