huntrule

Linux: Process executing update-ca-certificates or update-ca-trust

Detects Linux executions of update-ca-certificates or update-ca-trust that install new trusted root certificates.

FreeReviewedSigma · Low · v2
Product
linux
Category
process_creation
Author
Ömer Günal, oscd.community (SigmaHQ), DRL 1.1
Published
2020-10-05
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags execution of the Linux certificate trust update utilities /update-ca-certificates or /update-ca-trust, which results in installation of new trusted certificates system-wide. Attackers may abuse this behavior to establish trust for attacker-controlled endpoints and reduce browser or client warnings when connecting to C2 or other infrastructure. The detection relies on process creation telemetry that captures the executed command path ending with either of those utilities.

Reporting behind it

Related detections9 linkedT1553.004 — drag to rearrange
Windows AD CS Denied Certificate Enrollment Requests (Event ID 53)
Windows: Root Certificate Added Using certutil.exe -addstore
Windows: Root Certificate Installation via CertMgr.EXE (/add root)
Linux Package Installation via apt/yum/rpm/dpkg with Networking Tools Keywords
Windows Process Creation: Suspicious X509Enrollment.CBinaryConverter Execution
Suspicious X509Enrollment usage in Windows PowerShell scripts
Windows Root Certificate Installation from Suspicious Paths via PowerShell Import-Certificate
PowerShell Root Certificate Added via LocalMachine\Root Path
Cisco IOS AAA Crypto PKI Export/Import Commands
Linux: Process executing update-ca-certificates or update-ca-trust
Pivot detection · T1553.004 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.