Windows: Root Certificate Installation via CertMgr.EXE (/add root)
Flags CertMgr.EXE used to add a root certificate on Windows by matching /add and root in the command line.
- Product
- windows
- Category
- process_creation
- Author
- oscd.community, @redcanary, Zach Stanford @svch0st (SigmaHQ), DRL 1.1
- Published
- 2023-03-05
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process executions where CertMgr.EXE (or CERTMGT.EXE) is run with command-line arguments indicating a root certificate was added. Installing or modifying trusted root certificates can help attackers bypass browser or TLS trust warnings for connections they control. It relies on process creation telemetry including the executable path/name and the full command line containing the add and root indicators.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md
- securelist.comhttps://securelist.com/to-crypt-or-to-mine-that-is-the-question/86307/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_certmgr_certificate_installation.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Root Certificate Installation via CertMgr.EXE (/add root)"
id: f45e5401-9a63-43ea-986a-264ebc3b47be
related:
- id: 42821614-9264-4761-acfc-5772c3286f76
type: derived
- id: 46591fae-7a4c-46ea-aec3-dff5e6d785dc
type: obsolete
- id: ff992eac-6449-4c60-8c1d-91c9722a1d48
type: derived
status: test
description: This rule flags Windows process executions where CertMgr.EXE (or CERTMGT.EXE) is run with command-line arguments indicating a root certificate was added. Installing or modifying trusted root certificates can help attackers bypass browser or TLS trust warnings for connections they control. It relies on process creation telemetry including the executable path/name and the full command line containing the add and root indicators.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md
- https://securelist.com/to-crypt-or-to-mine-that-is-the-question/86307/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_certmgr_certificate_installation.yml
author: oscd.community, @redcanary, Zach Stanford @svch0st, Huntrule Team
date: 2023-03-05
tags:
- attack.defense-impairment
- attack.t1553.004
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \CertMgr.exe
- OriginalFileName: CERTMGT.EXE
selection_cli:
CommandLine|contains|all:
- /add
- root
condition: all of selection_*
falsepositives:
- Help Desk or IT may need to manually add a corporate Root CA on occasion. Need to test if GPO push doesn't trigger FP
level: medium
license: DRL-1.1