Windows: CertOC.exe Loads DLL via -LoadDLL Argument

title: "Windows: CertOC.exe Loads DLL via -LoadDLL Argument"
id: 1571ebb8-5879-4639-8247-cbd1f290d959
related:
  - id: 84232095-ecca-4015-b0d7-7726507ee793
    type: similar
  - id: 242301bc-f92f-4476-8718-78004a6efd9f
    type: derived
status: test
description: This rule detects process creation where CertOC.exe is used to load a DLL using the -LoadDLL command-line argument. Loading a DLL in this manner can be used by attackers to execute or stage functionality stealthily. The detection relies on Windows process creation telemetry, specifically the executable path/name and the presence of the -LoadDLL option in the command line.
references:
  - https://twitter.com/sblmsrsn/status/1445758411803480072?s=20
  - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-fe98e74189873d6df72a15df2eaa0315c59ba9cdaca93ecd68afc4ea09194ef2
  - https://lolbas-project.github.io/lolbas/Binaries/Certoc/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_certoc_load_dll.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-10-23
modified: 2024-03-05
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \certoc.exe
    - OriginalFileName: CertOC.exe
  selection_cli:
    CommandLine|contains|windash: " -LoadDLL "
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1