Windows: Root Certificate Added Using certutil.exe -addstore

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1553.004Install Root Certificate
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Windows process executions of certutil.exe that include the -addstore flag and specify the root certificate store. Installing a root certificate can enable an attacker to reduce browser or TLS warning prompts when intercepting or proxying traffic to adversary-controlled sites. It relies on process creation telemetry, matching the image path/OriginalFileName and filtering on command-line content.

Reporting behind it

Related detections9 linkedT1553.004 — drag to rearrange

Windows AD CS Denied Certificate Enrollment Requests (Event ID 53)

Windows: Root Certificate Installation via CertMgr.EXE (/add root)

Linux Package Installation via apt/yum/rpm/dpkg with Networking Tools Keywords

Windows Process Creation: Suspicious X509Enrollment.CBinaryConverter Execution

Suspicious X509Enrollment usage in Windows PowerShell scripts

Windows Root Certificate Installation from Suspicious Paths via PowerShell Import-Certificate

PowerShell Root Certificate Added via LocalMachine\Root Path

Linux: Process executing update-ca-certificates or update-ca-trust

Cisco IOS AAA Crypto PKI Export/Import Commands

Windows: Root Certificate Added Using certutil.exe -addstore

Pivot detection · T1553.004 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-certutil-exe-root-certificate-installation-via-addstore-d2125259

title: "Windows: Root Certificate Added Using certutil.exe -addstore"
id: 05e7dc88-93ec-4885-8530-fe3f94d20863
related:
  - id: 42821614-9264-4761-acfc-5772c3286f76
    type: derived
  - id: 46591fae-7a4c-46ea-aec3-dff5e6d785dc
    type: obsolete
  - id: d2125259-ddea-4c1c-9c22-977eb5b29cf0
    type: derived
status: test
description: This rule identifies Windows process executions of certutil.exe that include the -addstore flag and specify the root certificate store. Installing a root certificate can enable an attacker to reduce browser or TLS warning prompts when intercepting or proxying traffic to adversary-controlled sites. It relies on process creation telemetry, matching the image path/OriginalFileName and filtering on command-line content.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_certutil_certificate_installation.yml
author: oscd.community, @redcanary, Zach Stanford @svch0st, Huntrule Team
date: 2023-03-05
modified: 2024-03-05
tags:
  - attack.defense-impairment
  - attack.t1553.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \certutil.exe
    - OriginalFileName: CertUtil.exe
  selection_cli_add:
    CommandLine|contains|windash: -addstore
  selection_cli_store:
    CommandLine|contains: root
  condition: all of selection_*
falsepositives:
  - Help Desk or IT may need to manually add a corporate Root CA on occasion. Need to test if GPO push doesn't trigger FP
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_certificate_installation/info.yml
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL