Linux Certificate Store Update: Installing Root Certificates via ca-certificates Commands
Detects Linux executions of update-ca-certificates or update-ca-trust that install new trusted root certificates.
- Product
- linux
- Category
- process_creation
- Author
- Ömer Günal, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2020-10-05
- Updated
- 2026-10-14
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Linux process creation commands that include certificate store update operations for both CA certificates and CA trust. Attackers can install new trusted root certificates to reduce or bypass TLS validation warnings when connecting to attacker-controlled web servers or infrastructure. It relies on process command-line telemetry that contains the specific update-ca-certificates and update-ca-trust invocations. Legitimate administration may trigger the alert.
Reporting behind it
- trendmicro.comhttps://www.trendmicro.com/en_us/research/14/h/finding-holes-operation-emmental.html
- kaspersky.comhttps://www.kaspersky.com/blog/lenovo-pc-with-adware-superfish-preinstalled/
- cisa.govhttps://www.cisa.gov/news-events/alerts/2015/02/20/lenovo-superfish-adware-vulnerable-https-spoofing
- capec.mitre.orghttps://capec.mitre.org/data/definitions/479.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_install_root_certificate.yml
Changelog
v4- v4Candidate ingested via manual entry.2026-10-14
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Linux Certificate Store Update: Installing Root Certificates via ca-certificates Commands"
id: 10c1146d-0002-430d-8aae-573303067250
status: test
description: This rule flags Linux process creation commands that include certificate store update operations for both CA certificates and CA trust. Attackers can install new trusted root certificates to reduce or bypass TLS validation warnings when connecting to attacker-controlled web servers or infrastructure. It relies on process command-line telemetry that contains the specific update-ca-certificates and update-ca-trust invocations. Legitimate administration may trigger the alert.
references:
- https://www.trendmicro.com/en_us/research/14/h/finding-holes-operation-emmental.html
- https://www.kaspersky.com/blog/lenovo-pc-with-adware-superfish-preinstalled/
- https://www.cisa.gov/news-events/alerts/2015/02/20/lenovo-superfish-adware-vulnerable-https-spoofing
- https://capec.mitre.org/data/definitions/479.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_install_root_certificate.yml
author: Ömer Günal, oscd.community, Huntrule Team
date: 2020-10-05
modified: 2026-10-04
tags:
- attack.defense-impairment
- attack.t1553.004
logsource:
product: linux
category: process_creation
detection:
selection:
CommandLine|contains:
- /update-ca-certificates
- /update-ca-trust
condition: selection
falsepositives:
- Legitimate administration activities
level: low
simulation:
- type: atomic-red-team
name: Install root CA on CentOS/RHEL
technique: T1553.004
atomic_guid: 9c096ec4-fd42-419d-a762-d64cc950627e
- type: atomic-red-team
name: Install root CA on Debian/Ubuntu
technique: T1553.004
atomic_guid: 53bcf8a0-1549-4b85-b919-010c56d724ff
license: DRL-1.1
related:
- id: 78a80655-a51e-4669-bc6b-e9d206a462ee
type: derived