PowerShell root certificate installation via Cert:\LocalMachine\Root

Flags PowerShell scripts that move and import certificates into the local machine root store (Cert:\LocalMachine\Root).

FreeUnreviewedSigmamediumv1

powershell-root-certificate-installation-via-cert-localmachine-root-42821614

title: PowerShell root certificate installation via Cert:\LocalMachine\Root
id: 5f7f5a40-bbeb-43fd-bdaf-7182f6b64d4f
status: test
description: This rule identifies PowerShell script content that moves a file into the local machine root certificate store and then imports a certificate into Cert:\LocalMachine\Root. Installing a root certificate can help an attacker establish trust and avoid browser or client warnings when connecting to attacker-controlled TLS endpoints. The detection relies on PowerShell script block telemetry capturing the specific cmdlets and certificate store paths.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_root_certificate_installed.yml
author: oscd.community, @redcanary, Zach Stanford @svch0st, Huntrule Team
date: 2020-10-10
modified: 2022-12-02
tags:
  - attack.defense-impairment
  - attack.t1553.004
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection1:
    ScriptBlockText|contains|all:
      - Move-Item
      - Cert:\LocalMachine\Root
  selection2:
    ScriptBlockText|contains|all:
      - Import-Certificate
      - Cert:\LocalMachine\Root
  condition: 1 of selection*
falsepositives:
  - Help Desk or IT may need to manually add a corporate Root CA on occasion. Need to test if GPO push doesn't trigger FP
level: medium
license: DRL-1.1
related:
  - id: 42821614-9264-4761-acfc-5772c3286f76
    type: derived

What it detects

This rule identifies PowerShell script content that moves a file into the local machine root certificate store and then imports a certificate into Cert:\LocalMachine\Root. Installing a root certificate can help an attacker establish trust and avoid browser or client warnings when connecting to attacker-controlled TLS endpoints. The detection relies on PowerShell script block telemetry capturing the specific cmdlets and certificate store paths.

Known false positives

Help Desk or IT may need to manually add a corporate Root CA on occasion. Need to test if GPO push doesn't trigger FP

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.