Sigma rule: New Root or CA or AuthRoot Certificate to Store

Rule

Title

New Root or CA or AuthRoot Certificate to Store

Status

test

Level

medium

Author

frack113

Date

2022-04-04

Modified

2023-08-17

File

rules/windows/registry/registry_set/registry_set_install_root_or_ca_certificat.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the addition of new root, CA or AuthRoot certificates to the Windows registry

Log source

product

windows

category

registry_set

Detection

selection:
    TargetObject|contains:
        - '\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates\'
        - '\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates\'
        - '\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\'
        - '\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\'
        - '\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates\'
        - '\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates\'
        - '\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\'
        - '\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot\Certificates\'
        - '\SOFTWARE\Microsoft\EnterpriseCertificates\AuthRoot\Certificates\'
    TargetObject|endswith: '\Blob'
    Details: 'Binary Data'
condition: selection

False positives (as the rule lists them)

• Unknown

Tags

• attack.impact
• attack.t1490

MITRE ATT&CK ids this rule names

• T1490

References

• https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md#atomic-test-6---add-root-certificate-to-currentuser-certificate-store
• https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/registry/registry_set/registry_set_install_root_or_ca_certificat.yml