Suspicious DLL Loading via CertOC.exe from Temporary Paths
This rule detects suspicious activity involving `CertOC.exe` loading a DLL from unusual or temporary paths. `CertOC.exe` is a legitimate Windows binary used for certificate operations, but it can be abused to load arbitrary DLLs, a technique often used for defense evasion or privilege escalation. The rule specifically looks for `CertOC.exe` being executed with the `-LoadDLL` command-line argument, combined with the DLL path being located in common temporary or user-writable directories like `AppData\Local\Temp`, `Desktop`, `Downloads`, `Users\Public`, `C:\Windows\Tasks`, or `C:\Windows\Temp`.
Sigma
