Windows: Certutil.exe Root Certificate Installation via -addstore

Flags certutil.exe executions that use -addstore with root-related parameters to install a certificate.

FreeUnreviewedSigmamediumv1

windows-certutil-exe-root-certificate-installation-via-addstore-d2125259

title: "Windows: Certutil.exe Root Certificate Installation via -addstore"
id: 05e7dc88-93ec-4885-8530-fe3f94d20863
related:
  - id: 42821614-9264-4761-acfc-5772c3286f76
    type: derived
  - id: 46591fae-7a4c-46ea-aec3-dff5e6d785dc
    type: obsolete
  - id: d2125259-ddea-4c1c-9c22-977eb5b29cf0
    type: derived
status: test
description: This rule identifies process executions of certutil.exe using the -addstore flag with parameters indicating a root certificate installation. Installing a root certificate can weaken trust boundaries by allowing the system to trust attacker-controlled certificates. It relies on Windows process creation telemetry including the executable path/filename and command-line arguments.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_certutil_certificate_installation.yml
author: oscd.community, @redcanary, Zach Stanford @svch0st, Huntrule Team
date: 2023-03-05
modified: 2024-03-05
tags:
  - attack.defense-impairment
  - attack.t1553.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \certutil.exe
    - OriginalFileName: CertUtil.exe
  selection_cli_add:
    CommandLine|contains|windash: -addstore
  selection_cli_store:
    CommandLine|contains: root
  condition: all of selection_*
falsepositives:
  - Help Desk or IT may need to manually add a corporate Root CA on occasion. Need to test if GPO push doesn't trigger FP
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_certificate_installation/info.yml
license: DRL-1.1

What it detects

This rule identifies process executions of certutil.exe using the -addstore flag with parameters indicating a root certificate installation. Installing a root certificate can weaken trust boundaries by allowing the system to trust attacker-controlled certificates. It relies on Windows process creation telemetry including the executable path/filename and command-line arguments.

Known false positives

Help Desk or IT may need to manually add a corporate Root CA on occasion. Need to test if GPO push doesn't trigger FP

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.