Elastic Defend high stable eql

Suspicious ImageLoad via Windows CertOC

Identifies abuse of the Microsoft CertOC utility to load an arbitrary DLL. This behavior is used as a defense evasion technique to blend-in malicious activity with legitimate Windows software.

View Source

Detection Logic

process where event.action == "start" and
  (process.pe.original_file_name == "CertOC.exe" or process.name : "certoc.exe") and process.args : "-LoadDLL"

Field Validations

Loading…

Comments (0)

Loading comments...