huntrule

CertOC.EXE File Download via -GetCACAPS http on Windows

Flags CertOC.exe launched with -GetCACAPS and an http URL, indicating a remote file retrieval attempt.

FreeUnreviewedSigmamediumv1
title: CertOC.EXE File Download via -GetCACAPS http on Windows
id: d7704bec-f020-4ccc-b50b-42468760cca4
related:
  - id: b86f6dea-0b2f-41f5-bdcc-a057bd19cd6a
    type: similar
  - id: 70ad0861-d1fe-491c-a45f-fa48148a300d
    type: derived
status: test
description: This rule identifies Windows process executions where CertOC.exe is launched with arguments that include -GetCACAPS and an http URL. Attackers can use signed-binary utilities like CertOC.exe to retrieve remote content as part of command-and-control or staging workflows. It relies on process creation telemetry, matching the process image name and the required command-line arguments.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Certoc/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_certoc_download.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-05-16
modified: 2023-10-18
tags:
  - attack.command-and-control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \certoc.exe
    - OriginalFileName: CertOC.exe
  selection_cli:
    CommandLine|contains|all:
      - -GetCACAPS
      - http
  condition: all of selection*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

What it detects

This rule identifies Windows process executions where CertOC.exe is launched with arguments that include -GetCACAPS and an http URL. Attackers can use signed-binary utilities like CertOC.exe to retrieve remote content as part of command-and-control or staging workflows. It relies on process creation telemetry, matching the process image name and the required command-line arguments.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.