Skip to content
Threat Feed
Subscribe
medium advisory

Detection of Unauthorized Root or CA Certificate Installation

Adversaries can install malicious root or CA certificates into the Windows registry to facilitate traffic interception, bypass security controls, and establish persistence.

The installation of unauthorized root or Certification Authority (CA) certificates into the Windows registry is a technique used by adversaries to facilitate malicious activities such as man-in-the-middle (MitM) attacks, bypass certificate validation for malicious payloads, and ensure the persistence of rogue communication channels. By modifying specific registry keys within the SystemCertificates hive, an attacker can force the operating system to trust a compromised or attacker-controlled certificate. This technique is often observed during post-exploitation phases or as a means to subvert enterprise-grade security appliances that rely on SSL/TLS inspection. Defenders should prioritize visibility into registry modifications affecting the Windows certificate store to identify unauthorized trust anchors being added to the environment.

Impact

Successful installation of unauthorized root certificates allows attackers to intercept encrypted traffic, bypass application-level certificate pinning, and establish persistent access by masquerading as trusted internal services or entities, leading to potential data exfiltration and credential theft.

Recommendation

  1. Deploy the provided Sigma rule to monitor registry modifications within the Windows Certificate Store locations.
  2. Implement an allowlist for known enterprise CA certificates and alert on any additions to the Root, CA, or AuthRoot certificate stores not initiated by authorized management software.
  3. Regularly audit endpoints for unexpected certificates in the registry and compare them against approved organizational certificate inventories.

Immediate actions

Deploy the Sigma rule to monitor for unauthorized certificate store modifications.

Detection Engineering 72h

Threat Hunt

Search for existing root certificate installations that do not match the organization's approved certificate inventory.

T1553.004 medium medium confidence hunt now

Data: Registry audit logs, Certificate store inventory exports

Mitigations

Use Group Policy or MDM to enforce approved certificate stores and restrict unauthorized modifications.

medium IT Operations

T1553.004

Detection coverage 1

Detect Addition of New Root or CA Certificate to Windows Registry

medium

Detects the addition of new root, CA or AuthRoot certificates to the Windows registry by monitoring modifications to Certificate Store registry keys.

sigma tactics: impact techniques: T1553.004 sources: registry_set, windows

Detection queries are available on the platform. Get full rules →