Detection of Malicious Root Certificate Installation on Linux

Attackers may install unauthorized root certificates on a compromised system to intercept, inspect, or modify TLS-encrypted traffic. By adding a rogue certificate to the system's trusted store, an attacker can effectively bypass browser and application warnings when performing Man-in-the-Middle (MitM) attacks against C2 communications or sensitive user data. This technique is often associated with the delivery of adware or persistent spyware capable of monitoring encrypted sessions. Defenders should monitor for the execution of system update utilities that modify certificate trust stores, such as 'update-ca-certificates' on Debian-based systems or 'update-ca-trust' on RHEL-based systems. These actions are legitimate administrative tasks but represent a high-risk activity when performed outside of authorized configuration management or maintenance windows.

Impact

Successful installation of an unauthorized root certificate can lead to the total compromise of confidentiality for all network traffic originating from the affected host, as the attacker can sign malicious traffic with a trusted identity. This technique has historically been utilized by adware vendors to inject content into encrypted sessions and by advanced actors to maintain persistence within an environment while evading detection by network security monitoring tools.

Recommendation

Deploy detection rules to monitor for the execution of certificate store update utilities on critical infrastructure and workstations.

• Deploy the Sigma rule in this brief to your SIEM to alert on the modification of local certificate trust stores.
• Review logs for any unauthorized execution of 'update-ca-certificates' or 'update-ca-trust' as part of your daily threat hunting or log review procedures.
• Establish an allowlist for known administrative service accounts or configuration management tools (such as Ansible, Salt, or Puppet) that legitimately trigger these binaries.