Used for installing certificates Located at: c:\windows\system32\certoc.exe; c:\windows\syswow64\certoc.exe.
certoccertocSandbox: execFile · Timeout: 30s
security.execution.command network.transfer.download Outputs
process.output Command execution output
network_trafficprocess_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | medium |
| Disk I/O | low |
Loads the target DLL file (Execute code within DLL file)
certoc.exe -LoadDLL {PATH_ABSOLUTE:.dll}Downloads text formatted files (Download scripts, webshells etc.)
certoc.exe -GetCACAPS {REMOTEURL:.ps1}| Type | Rule / Indicator |
|---|---|
| sigma | https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_certoc_load_dll.yml |
| ioc | Process creation with given parameter |
| ioc | Unsigned DLL load via certoc.exe |
| ioc | Network connection via certoc.exe |
certoc is a Windows LOLBin. Used for installing certificates Located at: c:\windows\system32\certoc.exe; c:\windows\syswow64\certoc.exe.