Windows Registry: New Root CA or AuthRoot Certificates Added to Certificate Stores

ATT&CK techniques

Impact

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
- T1490Inhibit System Recovery

What it detects

This rule flags Windows Registry writes where the TargetObject path indicates Root, CA, or AuthRoot certificate stores under HKLM, HKCU policies/enterprise areas. Adding certificates to these stores can allow attackers to trust attacker-controlled keys, enabling code-signing and TLS trust abuse. It relies on registry set events with TargetObject paths for the certificate store locations and entries that end with \Blob containing binary certificate data.

Reporting behind it

Related detections9 linkedT1490 — drag to rearrange

Malicious Mass Hyper-V Virtual Machine Shutdown via PowerShell by Kraken Ransomware

Suspicious Shadow Copy Deletion via Vssadmin by Kraken Ransomware

Malicious Volume Shadow Copy Deletion via vssadmin or WMIC

Malicious Volume Shadow Copy Deletion via vssadmin

Suspicious Free Space Wipe via cipher.exe

Malicious Shadow Copy Deletion Via WMI

Volume Shadow Copy Deletion via vssadmin or wmic

Malicious Inhibit System Recovery via Backup and Shadow Copy Deletion (via process_creation)

Malicious Shadow Copy Deletion via vssadmin

Windows Registry: New Root CA or AuthRoot Certificates Added to Certificate Stores

Pivot detection · T1490 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-registry-new-root-ca-or-authroot-certificates-added-to-certificate-store-d223b46b

title: "Windows Registry: New Root CA or AuthRoot Certificates Added to Certificate Stores"
id: 15a3660c-a29e-4ea3-85dd-cc2e8c1004b8
status: test
description: This rule flags Windows Registry writes where the TargetObject path indicates Root, CA, or AuthRoot certificate stores under HKLM, HKCU policies/enterprise areas. Adding certificates to these stores can allow attackers to trust attacker-controlled keys, enabling code-signing and TLS trust abuse. It relies on registry set events with TargetObject paths for the certificate store locations and entries that end with \Blob containing binary certificate data.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md#atomic-test-6---add-root-certificate-to-currentuser-certificate-store
  - https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_install_root_or_ca_certificat.yml
author: frack113, Huntrule Team
date: 2022-04-04
modified: 2023-08-17
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
      - \SOFTWARE\Microsoft\SystemCertificates\Root\Certificates\
      - \SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates\
      - \SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\
      - \SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\
      - \SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates\
      - \SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates\
      - \SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\
      - \SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot\Certificates\
      - \SOFTWARE\Microsoft\EnterpriseCertificates\AuthRoot\Certificates\
    TargetObject|endswith: \Blob
    Details: Binary Data
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: d223b46b-5621-4037-88fe-fda32eead684
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL