File Download From IP Based URL Via CertOC.EXE
Detects when the CertOC.exe utility is used to download a file from an IP address-based URL. This behavior is suspicious as CertOC.exe is a legitimate Windows binary that can be abused for ingress tool transfer, and downloading from an IP address directly often bypasses DNS-based security controls and can indicate malicious activity.
Sigma
