attack.t1553.004

Active Directory Certificate Services Denied Certificate Enrollment Request

Apr 28, 2026 · attack.credential-access attack.defense-impairment attack.t1553.004 ·

Detects denied requests by Active Directory Certificate Services. Example of these requests denial include issues with permissions on the certificate template or invalid signatures.

Cisco Crypto Commands

Apr 28, 2026 · attack.credential-access attack.defense-impairment attack.t1553.004 attack.t1552.004 ·

Share on:

Show when private keys are being exported from the device, or when new certificates are installed

Install Root Certificate

Apr 28, 2026 · attack.defense-impairment attack.t1553.004 ·

Share on:

Detects installation of new certificate on the system which attackers may use to avoid warnings when connecting to controlled web servers or C2s

New Root Certificate Installed Via CertMgr.EXE

Apr 28, 2026 · attack.defense-impairment attack.t1553.004 ·

Share on:

Detects execution of "certmgr" with the "add" flag in order to install a new certificate on the system. Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.

New Root Certificate Installed Via Certutil.EXE

Apr 28, 2026 · attack.defense-impairment attack.t1553.004 ·

Share on:

Detects execution of "certutil" with the "addstore" flag in order to install a new certificate on the system. Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.