Windows CertOC.exe Downloads File From IP-Based URL Using -GetCACAPS
Flags CertOC.exe executions using an IP-based URL in the command line with -GetCACAPS.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-10-18
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule identifies process executions of CertOC.exe where the command line includes an IP-based URL and the -GetCACAPS parameter, consistent with downloading content from a remote host. Attackers can use LOLBin-style utilities to retrieve payloads while blending into normal Windows binary usage. Telemetry required is Windows process creation data, including Image/OriginalFileName and the full CommandLine string.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows CertOC.exe Downloads File From IP-Based URL Using -GetCACAPS
id: a41c5cff-860f-4d3e-802f-94afda4e08b9
related:
- id: 70ad0861-d1fe-491c-a45f-fa48148a300d
type: similar
- id: b86f6dea-0b2f-41f5-bdcc-a057bd19cd6a
type: derived
status: test
description: This rule identifies process executions of CertOC.exe where the command line includes an IP-based URL and the -GetCACAPS parameter, consistent with downloading content from a remote host. Attackers can use LOLBin-style utilities to retrieve payloads while blending into normal Windows binary usage. Telemetry required is Windows process creation data, including Image/OriginalFileName and the full CommandLine string.
references:
- https://lolbas-project.github.io/lolbas/Binaries/Certoc/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_certoc_download_direct_ip.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-10-18
tags:
- attack.command-and-control
- attack.execution
- attack.t1105
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \certoc.exe
- OriginalFileName: CertOC.exe
selection_ip:
CommandLine|re: ://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}
selection_cli:
CommandLine|contains: -GetCACAPS
condition: all of selection*
falsepositives:
- Unknown
level: high
license: DRL-1.1