title: Root Certificate Installed
author: oscd.community, @redcanary, Zach Stanford @svch0st
date: 2020/10/10
description: Adversaries may install a root certificate on a compromised system to
  avoid warnings when connecting to adversary controlled web servers.
detection:
  SELECTION_1:
    EventID: 4104
  SELECTION_2:
    ScriptBlockText: '*Cert:\LocalMachine\Root*'
  SELECTION_3:
    ScriptBlockText: '*Move-Item*'
  SELECTION_4:
    ScriptBlockText: '*Import-Certificate*'
  condition: (SELECTION_1 and SELECTION_2 and (SELECTION_3 or SELECTION_4))
falsepositives:
- Help Desk or IT may need to manually add a corporate Root CA on occasion. Need to
  test if GPO push doesn't trigger FP
id: 42821614-9264-4761-acfc-5772c3286f76
level: medium
logsource:
  product: windows
  service: powershell
modified: 2021/09/21
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1553.004/T1553.004.md
status: experimental
tags:
- attack.defense_evasion
- attack.t1553.004
ruletype: SIGMA