Windows CertOC.exe Download via IP-Based URL (-GetCACAPS)

title: Windows CertOC.exe Download via IP-Based URL (-GetCACAPS)
id: a41c5cff-860f-4d3e-802f-94afda4e08b9
related:
  - id: 70ad0861-d1fe-491c-a45f-fa48148a300d
    type: similar
  - id: b86f6dea-0b2f-41f5-bdcc-a057bd19cd6a
    type: derived
status: test
description: This rule identifies process executions of CertOC.exe where the command line includes an IP-based URL and the -GetCACAPS argument. Attackers can use CertOC.exe to retrieve external content and blend execution into signed binary behavior. The detection relies on Windows process creation telemetry capturing the Image/OriginalFileName and the command line patterns that indicate an IP URL and the specific argument.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Certoc/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_certoc_download_direct_ip.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-10-18
tags:
  - attack.command-and-control
  - attack.execution
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \certoc.exe
    - OriginalFileName: CertOC.exe
  selection_ip:
    CommandLine|re: ://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}
  selection_cli:
    CommandLine|contains: -GetCACAPS
  condition: all of selection*
falsepositives:
  - Unknown
level: high
license: DRL-1.1