{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/certificate-manipulation/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["low"],"_cs_tags":["defense-impairment","linux","tls","certificate-manipulation"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eAttackers may install unauthorized root certificates on a compromised system to intercept, inspect, or modify TLS-encrypted traffic. By adding a rogue certificate to the system's trusted store, an attacker can effectively bypass browser and application warnings when performing Man-in-the-Middle (MitM) attacks against C2 communications or sensitive user data. This technique is often associated with the delivery of adware or persistent spyware capable of monitoring encrypted sessions. Defenders should monitor for the execution of system update utilities that modify certificate trust stores, such as 'update-ca-certificates' on Debian-based systems or 'update-ca-trust' on RHEL-based systems. These actions are legitimate administrative tasks but represent a high-risk activity when performed outside of authorized configuration management or maintenance windows.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful installation of an unauthorized root certificate can lead to the total compromise of confidentiality for all network traffic originating from the affected host, as the attacker can sign malicious traffic with a trusted identity. This technique has historically been utilized by adware vendors to inject content into encrypted sessions and by advanced actors to maintain persistence within an environment while evading detection by network security monitoring tools.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eDeploy detection rules to monitor for the execution of certificate store update utilities on critical infrastructure and workstations.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule in this brief to your SIEM to alert on the modification of local certificate trust stores.\u003c/li\u003e\n\u003cli\u003eReview logs for any unauthorized execution of 'update-ca-certificates' or 'update-ca-trust' as part of your daily threat hunting or log review procedures.\u003c/li\u003e\n\u003cli\u003eEstablish an allowlist for known administrative service accounts or configuration management tools (such as Ansible, Salt, or Puppet) that legitimately trigger these binaries.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-13T13:45:10Z","date_published":"2026-10-13T13:45:10Z","id":"https://feed.craftedsignal.io/briefs/2026-10-install-root-certificate/","summary":"This brief covers the detection of unauthorized root certificate installation on Linux systems, a technique used by attackers to intercept encrypted traffic and disable TLS warnings.","title":"Detection of Malicious Root Certificate Installation on Linux","url":"https://feed.craftedsignal.io/briefs/2026-10-install-root-certificate/"}],"language":"en","title":"CraftedSignal Threat Feed - Certificate-Manipulation","version":"https://jsonfeed.org/version/1.1"}