Windows Root Certificate Installation from Suspicious Paths via PowerShell Import-Certificate
Alerts on PowerShell importing a root certificate into Cert:\LocalMachine\Root from suspicious file paths on Windows.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-09-09
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process executions where PowerShell imports a certificate into the local machine trusted root store (Cert:\LocalMachine\Root) using Import-Certificate. It narrows to executions that reference file locations commonly abused for staging or user-writable content, such as Temp, Desktop, Downloads, Perflogs, and Public/AppData paths. Installing a root certificate can help attackers trust malicious TLS endpoints and reduce browser or application warnings. Telemetry relies on Windows process creation events including the full command line, specifically matching Import-Certificate targeting the Root store and the suspicious path strings.
Reporting behind it
- microsoft.comhttps://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/
- learn.microsoft.comhttps://learn.microsoft.com/en-us/powershell/module/pki/import-certificate?view=windowsserver2022-ps
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_import_cert_susp_locations.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Root Certificate Installation from Suspicious Paths via PowerShell Import-Certificate
id: d4d478be-4dce-481b-a2b0-aee3d530cdbd
status: test
description: This rule flags Windows process executions where PowerShell imports a certificate into the local machine trusted root store (Cert:\LocalMachine\Root) using Import-Certificate. It narrows to executions that reference file locations commonly abused for staging or user-writable content, such as Temp, Desktop, Downloads, Perflogs, and Public/AppData paths. Installing a root certificate can help attackers trust malicious TLS endpoints and reduce browser or application warnings. Telemetry relies on Windows process creation events including the full command line, specifically matching Import-Certificate targeting the Root store and the suspicious path strings.
references:
- https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/
- https://learn.microsoft.com/en-us/powershell/module/pki/import-certificate?view=windowsserver2022-ps
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_import_cert_susp_locations.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-09
modified: 2023-01-16
tags:
- attack.defense-impairment
- attack.t1553.004
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains|all:
- Import-Certificate
- " -FilePath "
- Cert:\LocalMachine\Root
CommandLine|contains:
- \AppData\Local\Temp\
- :\Windows\TEMP\
- \Desktop\
- \Downloads\
- \Perflogs\
- :\Users\Public\
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 5f6a601c-2ecb-498b-9c33-660362323afa
type: derived