Install Root Certificate

calendar Oct 13, 2026 · attack.defense-impairment attack.t1553.004  ·
Share on: linkedin copy

Detects installation of new certificate on the system which attackers may use to avoid warnings when connecting to controlled web servers or C2s

Sigma rule (View on GitHub)

 1title: Install Root Certificate
 2id: 78a80655-a51e-4669-bc6b-e9d206a462ee
 3status: test
 4description: Detects installation of new certificate on the system which attackers may use to avoid warnings when connecting to controlled web servers or C2s
 5references:
 6    - https://www.trendmicro.com/en_us/research/14/h/finding-holes-operation-emmental.html
 7    - https://www.kaspersky.com/blog/lenovo-pc-with-adware-superfish-preinstalled/
 8    - https://www.cisa.gov/news-events/alerts/2015/02/20/lenovo-superfish-adware-vulnerable-https-spoofing
 9    - https://capec.mitre.org/data/definitions/479.html
10author: Ömer Günal, oscd.community
11date: 2020-10-05
12modified: 2026-10-04
13tags:
14    - attack.defense-impairment
15    - attack.t1553.004
16logsource:
17    product: linux
18    category: process_creation
19detection:
20    selection:
21        CommandLine|contains:
22            - '/update-ca-certificates'
23            - '/update-ca-trust'
24    condition: selection
25falsepositives:
26    - Legitimate administration activities
27level: low
28simulation:
29    - type: atomic-red-team
30      name: Install root CA on CentOS/RHEL
31      technique: T1553.004
32      atomic_guid: 9c096ec4-fd42-419d-a762-d64cc950627e
33    - type: atomic-red-team
34      name: Install root CA on Debian/Ubuntu
35      technique: T1553.004
36      atomic_guid: 53bcf8a0-1549-4b85-b919-010c56d724ff

References

Related rules

to-top