PowerShell Root Certificate Added via LocalMachine\Root Path
Flags PowerShell scripts that move and import certificates into the local machine root store (Cert:\LocalMachine\Root).
- Product
- windows
- Category
- ps_script
- Author
- oscd.community, @redcanary, Zach Stanford @svch0st (SigmaHQ), DRL 1.1
- Published
- 2020-10-10
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell script blocks that move files into the local machine root certificate store and then import certificates into Cert:\LocalMachine\Root. Adversaries can use this behavior to install trust anchors and reduce certificate warnings when interacting with attacker-controlled infrastructure. It relies on Script Block Logging telemetry capturing PowerShell commands and certificate store path usage.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: PowerShell Root Certificate Added via LocalMachine\Root Path
id: 5f7f5a40-bbeb-43fd-bdaf-7182f6b64d4f
status: test
description: This rule flags PowerShell script blocks that move files into the local machine root certificate store and then import certificates into Cert:\LocalMachine\Root. Adversaries can use this behavior to install trust anchors and reduce certificate warnings when interacting with attacker-controlled infrastructure. It relies on Script Block Logging telemetry capturing PowerShell commands and certificate store path usage.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_root_certificate_installed.yml
author: oscd.community, @redcanary, Zach Stanford @svch0st, Huntrule Team
date: 2020-10-10
modified: 2022-12-02
tags:
- attack.defense-impairment
- attack.t1553.004
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection1:
ScriptBlockText|contains|all:
- Move-Item
- Cert:\LocalMachine\Root
selection2:
ScriptBlockText|contains|all:
- Import-Certificate
- Cert:\LocalMachine\Root
condition: 1 of selection*
falsepositives:
- Help Desk or IT may need to manually add a corporate Root CA on occasion. Need to test if GPO push doesn't trigger FP
level: medium
license: DRL-1.1
related:
- id: 42821614-9264-4761-acfc-5772c3286f76
type: derived