Identifier / Programs / Windows

certoc.exe

CertOC.exe file version info (xCyclopedia)

LOLBAS Execute, Download 6 Sigma rules name it 2 ATT&CK techniques 2 documented commands 1 known copy with hashes

How certoc.exe is abused

documented by LOLBAS

Execute T1218 System Binary Proxy Execution

-loaddll

Download T1105 Ingress Tool Transfer

-getcacaps

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for certoc.exe.

2 documented commands

from LOLBAS, each read by the identifier

Execute T1218 System Binary Proxy Execution User privileges

Loads the target DLL file

certoc.exe -LoadDLL {PATH_ABSOLUTE:.dll}

Identify

Trips 1 Sigma rule: mediumDLL Loaded via CertOC.EXE by Austin Songer @austinsonger

Download T1105 Ingress Tool Transfer User privileges

Downloads text formatted files

certoc.exe -GetCACAPS {REMOTEURL:.ps1}

Identify

Trips 1 Sigma rule: mediumFile Download via CertOC.EXE by Nasreddine Bencherchali (Nextron Systems)

All 2 commands the identifier reads trip a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for certoc.exe, by Ensar Samil, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for certoc.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

highFile Download From IP Based URL Via CertOC.EXENasreddine Bencherchali (Nextron Systems)

highSuspicious DLL Loaded via CertOC.EXENasreddine Bencherchali (Nextron Systems)

mediumFile Download via CertOC.EXENasreddine Bencherchali (Nextron Systems)

mediumDLL Loaded via CertOC.EXEAustin Songer @austinsonger

highSuspicious Microsoft OneNote Child ProcessTim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea)

highSuspicious Microsoft Office Child ProcessFlorian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io

T1105Ingress Tool Transfer

T1218System Binary Proxy Execution

Is it the real certoc.exe?

file version info and known copies

Installed inC:\Windows\system32\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionCertOC.exe

1 known copy

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\certoc.exe · signed by Microsoft Windows

debc4f3e7b3d7aa72763170660ec9382021935e675f3baa5e1a585b3c94fcd73

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.