Sigma rule: Install Root Certificate

Rule

Title

Install Root Certificate

Status

test

Level

low

Author

Ömer Günal, oscd.community

Date

2020-10-05

Modified

2026-10-04

File

rules/linux/process_creation/proc_creation_lnx_install_root_certificate.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects installation of new certificate on the system which attackers may use to avoid warnings when connecting to controlled web servers or C2s

Log source

product

linux

category

process_creation

Detection

selection:
    CommandLine|contains:
        - '/update-ca-certificates'
        - '/update-ca-trust'
condition: selection

False positives (as the rule lists them)

• Legitimate administration activities

Tags

• attack.defense-impairment
• attack.t1553.004

MITRE ATT&CK ids this rule names

• T1553.004

References

• https://www.trendmicro.com/en_us/research/14/h/finding-holes-operation-emmental.html
• https://www.kaspersky.com/blog/lenovo-pc-with-adware-superfish-preinstalled/
• https://www.cisa.gov/news-events/alerts/2015/02/20/lenovo-superfish-adware-vulnerable-https-spoofing
• https://capec.mitre.org/data/definitions/479.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/linux/process_creation/proc_creation_lnx_install_root_certificate.yml