Linux Root Certificate Installation via update-ca-certificates or update-ca-trust

title: Linux Root Certificate Installation via update-ca-certificates or update-ca-trust
id: 10c1146d-0002-430d-8aae-573303067250
status: test
description: This rule flags execution of the system certificate update utilities used to install new trusted root certificates. Attackers may abuse this process to introduce their own trust anchors and reduce browser or client warnings when connecting to controlled web servers or C2 infrastructure. It relies on process creation telemetry identifying the command image paths ending with /update-ca-certificates or /update-ca-trust.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_install_root_certificate.yml
author: Ömer Günal, oscd.community, Huntrule Team
date: 2020-10-05
modified: 2022-07-07
tags:
  - attack.defense-impairment
  - attack.t1553.004
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith:
      - /update-ca-certificates
      - /update-ca-trust
  condition: selection
falsepositives:
  - Legitimate administration activities
level: low
license: DRL-1.1
related:
  - id: 78a80655-a51e-4669-bc6b-e9d206a462ee
    type: derived