Windows CertMgr.EXE Root Certificate Added via /add /root

Flags CertMgr.EXE used to add a root certificate on Windows by matching /add and root in the command line.

FreeUnreviewedSigmamediumv1

windows-certmgr-exe-root-certificate-added-via-add-root-ff992eac

title: Windows CertMgr.EXE Root Certificate Added via /add /root
id: f45e5401-9a63-43ea-986a-264ebc3b47be
related:
  - id: 42821614-9264-4761-acfc-5772c3286f76
    type: derived
  - id: 46591fae-7a4c-46ea-aec3-dff5e6d785dc
    type: obsolete
  - id: ff992eac-6449-4c60-8c1d-91c9722a1d48
    type: derived
status: test
description: This rule matches Windows process creation where CertMgr.exe (or a binary identified by OriginalFileName CERTMGT.EXE) is executed with command-line arguments that include /add and root. Installing a root certificate enables traffic inspection or impersonation by causing the system to trust attacker-controlled certificates, which can help conceal malicious activity. It relies on process creation telemetry, including the image path and command-line arguments.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md
  - https://securelist.com/to-crypt-or-to-mine-that-is-the-question/86307/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_certmgr_certificate_installation.yml
author: oscd.community, @redcanary, Zach Stanford @svch0st, Huntrule Team
date: 2023-03-05
tags:
  - attack.defense-impairment
  - attack.t1553.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \CertMgr.exe
    - OriginalFileName: CERTMGT.EXE
  selection_cli:
    CommandLine|contains|all:
      - /add
      - root
  condition: all of selection_*
falsepositives:
  - Help Desk or IT may need to manually add a corporate Root CA on occasion. Need to test if GPO push doesn't trigger FP
level: medium
license: DRL-1.1

What it detects

This rule matches Windows process creation where CertMgr.exe (or a binary identified by OriginalFileName CERTMGT.EXE) is executed with command-line arguments that include /add and root. Installing a root certificate enables traffic inspection or impersonation by causing the system to trust attacker-controlled certificates, which can help conceal malicious activity. It relies on process creation telemetry, including the image path and command-line arguments.

Known false positives

Help Desk or IT may need to manually add a corporate Root CA on occasion. Need to test if GPO push doesn't trigger FP

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.