huntrule

Windows: CertOC.exe Loading DLL from User-Writable Paths

Alerts on CertOC.exe using -LoadDLL with DLLs from temp/user-writable directories on Windows.

FreeUnreviewedSigmahighv1
title: "Windows: CertOC.exe Loading DLL from User-Writable Paths"
id: 9f204adf-0823-4874-9b2e-f8155012453f
related:
  - id: 242301bc-f92f-4476-8718-78004a6efd9f
    type: similar
  - id: 84232095-ecca-4015-b0d7-7726507ee793
    type: derived
status: test
description: This rule flags process executions of CertOC.exe where the command line includes a -LoadDLL argument and the DLL path appears to be located in commonly user-writable or temporary directories. Attackers may abuse signed or trusted tooling like CertOC.exe to load an arbitrary DLL and execute malicious code. The detection relies on Windows process creation telemetry, specifically the Image/OriginalFileName fields and command-line contents indicating -LoadDLL plus suspicious path locations.
references:
  - https://twitter.com/sblmsrsn/status/1445758411803480072?s=20
  - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-fe98e74189873d6df72a15df2eaa0315c59ba9cdaca93ecd68afc4ea09194ef2
  - https://lolbas-project.github.io/lolbas/Binaries/Certoc/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_certoc_load_dll_susp_locations.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-02-15
modified: 2024-03-05
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \certoc.exe
    - OriginalFileName: CertOC.exe
  selection_cli:
    CommandLine|contains|windash: " -LoadDLL "
  selection_paths:
    CommandLine|contains:
      - \Appdata\Local\Temp\
      - \Desktop\
      - \Downloads\
      - \Users\Public\
      - C:\Windows\Tasks\
      - C:\Windows\Temp\
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags process executions of CertOC.exe where the command line includes a -LoadDLL argument and the DLL path appears to be located in commonly user-writable or temporary directories. Attackers may abuse signed or trusted tooling like CertOC.exe to load an arbitrary DLL and execute malicious code. The detection relies on Windows process creation telemetry, specifically the Image/OriginalFileName fields and command-line contents indicating -LoadDLL plus suspicious path locations.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.