I figured out that "C:\Windows\System32\certoc.exe -LoadDLL <DLLName>" can be used for loading DLLs. It looks like an alternative #lolbin to regsvr32.
📣 I partnered with @13CubedDFIR for a Valentine's Day Giveaway! 🎁
🏆 1 Grand Prize winner will receive one course of their choice from the list below + a 13Cubed Investigator T-Shirt.
Courses:
- Investigating Windows Endpoints
- Investigating Windows Memory
- Investigating macOS Endpoints
- Investigating Linux Devices
Each course comes with a Certificate of Completion as well as Certification attempts.
👕 5 winners will receive 13Cubed Investigator T-Shirts.
To Enter:
✅ Like
✅ Comment with the name of the course you want to win
✅ Repost
On Valentine's Day (February 14th, 2026) entries from across three social media platforms will be combined and winners will be selected.
For more info check out:
13Cubed Courses: https://t.co/xbinmzzOdI
Certification Information: https://t.co/IVM2zdyp62
T-Shirts: https://t.co/021POuAXQL
#DFIR #DigitalForensics #IncidentResponse
Today we mark 28 years since the #Srebrenica genocide in which 8372 Bosniak civilians were brutally murdered. They were killed after Serb forces attacked the UN "safe area" of Srebrenica in July 1995.
#SrebrenicaGenocide ▪️
I'm continuing to add my #ThreatHunting datasets to my github page https://t.co/XG151pO5XE. These hunts can easily be turned into #detections for Sysmon or @CrowdStrike . I'd recommend performing some statistical analysis within your env to determine know good to filter out.
A #LOLScript to register a DLL as COM+ Application. You can use it to load DLLs via "cscript.exe "C:\Program Files (x86)\Windows Kits\10\bin\10.0.22000.0\x64\register_app.vbs" -register <Provider_Name> <Provider.DLL> <Provider_Description>".
When you manage to land on a virtual machine which VMware Tools is installed, you can load your DLLs and register COM applications via "C:\Program Files\Common Files\VMware\vss\comreg.exe -register <DLL> <ServiceName> <ShortName> <Description>". #redteam#blueteam#infosec
I figured out that "C:\Windows\System32\certoc.exe -LoadDLL <DLLName>" can be used for loading DLLs. It looks like an alternative #lolbin to regsvr32.
There is an info about removal of this #lolbin for specific versions. Also, I could not find it on version 1607.
https://t.co/H8J63P5Rpq
I found it on latest 21H2 version.
I figured out that "C:\Windows\System32\certoc.exe -LoadDLL <DLLName>" can be used for loading DLLs. It looks like an alternative #lolbin to regsvr32.