Azure AD Audit: Trusted Root CA Added for Passwordless Certificate Authentication
Alerts on Azure AD changes that add a new trusted root CA for passwordless certificate-based authentication.
- Product
- azure
- Service
- auditlogs
- Author
- Harjot Shah Singh, '@cyb3rjy0t' (SigmaHQ), DRL 1.1
- Published
- 2024-03-26
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags when an Azure AD tenant updates the company information to include a new trusted certificate authority value under TrustedCAsForPasswordlessAuth. Adding or changing a trusted root CA can enable certificate-based authentication paths and may support persistence by expanding what certificates the tenant will trust. It relies on Azure AD audit log events for the specific operation (Set Company Information) and the presence of the TrustedCAsForPasswordlessAuth value in the modified property newValue.
Reporting behind it
- posts.specterops.iohttps://posts.specterops.io/passwordless-persistence-and-privilege-escalation-in-azure-98a01310be3f
- goodworkaround.comhttps://goodworkaround.com/2022/02/15/digging-into-azure-ad-certificate-based-authentication/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_ad_new_root_ca_added.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Azure AD Audit: Trusted Root CA Added for Passwordless Certificate Authentication"
id: 9c3e52a0-1dd5-4ad1-a910-0bf86f8654d5
status: test
description: This rule flags when an Azure AD tenant updates the company information to include a new trusted certificate authority value under TrustedCAsForPasswordlessAuth. Adding or changing a trusted root CA can enable certificate-based authentication paths and may support persistence by expanding what certificates the tenant will trust. It relies on Azure AD audit log events for the specific operation (Set Company Information) and the presence of the TrustedCAsForPasswordlessAuth value in the modified property newValue.
references:
- https://posts.specterops.io/passwordless-persistence-and-privilege-escalation-in-azure-98a01310be3f
- https://goodworkaround.com/2022/02/15/digging-into-azure-ad-certificate-based-authentication/
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_ad_new_root_ca_added.yml
author: Harjot Shah Singh, '@cyb3rjy0t', Huntrule Team
date: 2024-03-26
tags:
- attack.credential-access
- attack.persistence
- attack.privilege-escalation
- attack.defense-impairment
- attack.t1556
logsource:
product: azure
service: auditlogs
detection:
selection:
OperationName: Set Company Information
TargetResources.modifiedProperties.newValue|contains: TrustedCAsForPasswordlessAuth
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 4bb80281-3756-4ec8-a88e-523c5a6fda9e
type: derived