DLL Loaded via CertOC.exe
Detects when 'CertOC.exe' is used to load a DLL, which can be an indicator of System Binary Proxy Execution. Adversaries may abuse trusted Microsoft-signed binaries like CertOC.exe to bypass defenses and execute malicious code.
Sigma
