Windows: CertOC.exe Loading a DLL from User-Writable Paths via -LoadDLL
Alerts on CertOC.exe using -LoadDLL with DLLs from temp/user-writable directories on Windows.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-02-15
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies executions of CertOC.exe where the command line includes the -LoadDLL argument and the target DLL is referenced from common user-writable or staging locations. Using CertOC.exe to load a DLL can support stealthy execution by proxying library loads through a signed Microsoft-signed utility. The detection relies on Windows process creation telemetry, specifically the process image/original file name, the command line containing -LoadDLL, and the presence of suspicious file paths in the command line.
Reporting behind it
- twitter.comhttps://twitter.com/sblmsrsn/status/1445758411803480072?s=20
- github.comhttps://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-fe98e74189873d6df72a15df2eaa0315c59ba9cdaca93ecd68afc4ea09194ef2
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/Binaries/Certoc/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_certoc_load_dll_susp_locations.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: CertOC.exe Loading a DLL from User-Writable Paths via -LoadDLL"
id: 9f204adf-0823-4874-9b2e-f8155012453f
related:
- id: 242301bc-f92f-4476-8718-78004a6efd9f
type: similar
- id: 84232095-ecca-4015-b0d7-7726507ee793
type: derived
status: test
description: This rule identifies executions of CertOC.exe where the command line includes the -LoadDLL argument and the target DLL is referenced from common user-writable or staging locations. Using CertOC.exe to load a DLL can support stealthy execution by proxying library loads through a signed Microsoft-signed utility. The detection relies on Windows process creation telemetry, specifically the process image/original file name, the command line containing -LoadDLL, and the presence of suspicious file paths in the command line.
references:
- https://twitter.com/sblmsrsn/status/1445758411803480072?s=20
- https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-fe98e74189873d6df72a15df2eaa0315c59ba9cdaca93ecd68afc4ea09194ef2
- https://lolbas-project.github.io/lolbas/Binaries/Certoc/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_certoc_load_dll_susp_locations.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-02-15
modified: 2024-03-05
tags:
- attack.stealth
- attack.t1218
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \certoc.exe
- OriginalFileName: CertOC.exe
selection_cli:
CommandLine|contains|windash: " -LoadDLL "
selection_paths:
CommandLine|contains:
- \Appdata\Local\Temp\
- \Desktop\
- \Downloads\
- \Users\Public\
- C:\Windows\Tasks\
- C:\Windows\Temp\
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1