huntrule

Windows Registry: New Root CA or AuthRoot Certificates Added to Certificate Stores

Alerts on registry certificate-store writes adding new Root/CA/AuthRoot certificates as binary blobs.

FreeUnreviewedSigmamediumv1
title: "Windows Registry: New Root CA or AuthRoot Certificates Added to Certificate Stores"
id: 15a3660c-a29e-4ea3-85dd-cc2e8c1004b8
status: test
description: This rule flags Windows Registry writes where the TargetObject path indicates Root, CA, or AuthRoot certificate stores under HKLM, HKCU policies/enterprise areas. Adding certificates to these stores can allow attackers to trust attacker-controlled keys, enabling code-signing and TLS trust abuse. It relies on registry set events with TargetObject paths for the certificate store locations and entries that end with \Blob containing binary certificate data.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md#atomic-test-6---add-root-certificate-to-currentuser-certificate-store
  - https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_install_root_or_ca_certificat.yml
author: frack113, Huntrule Team
date: 2022-04-04
modified: 2023-08-17
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
      - \SOFTWARE\Microsoft\SystemCertificates\Root\Certificates\
      - \SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates\
      - \SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\
      - \SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\
      - \SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates\
      - \SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates\
      - \SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\
      - \SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot\Certificates\
      - \SOFTWARE\Microsoft\EnterpriseCertificates\AuthRoot\Certificates\
    TargetObject|endswith: \Blob
    Details: Binary Data
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: d223b46b-5621-4037-88fe-fda32eead684
    type: derived

What it detects

This rule flags Windows Registry writes where the TargetObject path indicates Root, CA, or AuthRoot certificate stores under HKLM, HKCU policies/enterprise areas. Adding certificates to these stores can allow attackers to trust attacker-controlled keys, enabling code-signing and TLS trust abuse. It relies on registry set events with TargetObject paths for the certificate store locations and entries that end with \Blob containing binary certificate data.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.