Detection of Unauthorized Root CA Certificate Installation via Windows Registry

Unauthorized installation of root Certificate Authority (CA) certificates within the Windows Registry is a technique frequently employed by threat actors to compromise the integrity of encrypted network traffic. By adding a malicious root certificate to the Windows trust store, attackers can effectively perform man-in-the-middle (MITM) attacks, enabling them to intercept, decrypt, or manipulate sensitive data transmitted over HTTPS or other TLS-encrypted protocols.

Defenders should monitor registry modification events, specifically targeting paths associated with system certificates. The presence of a new "Blob" value within certificate-related registry keys is a high-fidelity indicator of a certificate store modification. While this behavior can occasionally be associated with legitimate software updates, it remains a critical monitoring point to ensure endpoint integrity and prevent persistent access to encrypted communications by unauthorized parties.

Impact

Successful exploitation of this technique compromises the trust model of the affected endpoint. Attackers can leverage this to perform clandestine interception of encrypted sessions, inject malicious content into web traffic, or validate untrusted code as legitimate. This facilitates a wide range of follow-on attacks, including credential harvesting, session hijacking, and the delivery of secondary payloads, leading to potential data breaches and total loss of confidentiality for network communications.

Recommendation

Detection engineering teams should implement monitoring for registry modifications that signal the installation of new CA certificates.

• Deploy the provided Sigma rule to detect registry modifications targeting certificate storage paths.
• Enable Sysmon Event ID 13 (RegistryValueset) to capture the necessary telemetry for this detection.
• Audit authorized certificate installation workflows to baseline legitimate behavior and reduce false positives.