T1553.004 — Install Root Certificate

Tactic: Defense Impairment · Platforms: Linux, macOS, Windows

Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or…

Sub-technique of Subvert Trust Controls (T1553).

Sigma detection rules (3)

T1553.004 Subvert Trust Controls: Install Root Certificate

title: "T1553.004 Subvert Trust Controls: Install Root Certificate"
id: a45a6634-8252-4ed4-a331-07e1c50b7231
description: 'Detects a certificate being added to the Windows Trusted Root Certification Authorities registry store (Sysmon EventID 13), indicating installation of a root CA certificate that could be abused to make adversary-controlled TLS traffic appear trusted. (Data Component: Windows Registry Key Creation; baseline tier: windows-eventid.) Tune using: TrustedRootHashList, MonitoredProcesses, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1553/004
author: Shahrukh Khan
date: 2026-03-24
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1553.004

logsource:
  category: registry_set
  product: windows

detection:
  selection:
    EventID: 13
    TargetObject|contains:
      - '\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\'
      - '\SOFTWARE\Microsoft\EnterpriseCertificates\ROOT\Certificates\'
      - '\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates\'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Legitimate enterprise CA deployment via Group Policy or MDM adding internal root certificates; System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.

level: medium

T1553.004 Subvert Trust Controls: Install Root Certificate

title: "T1553.004 Subvert Trust Controls: Install Root Certificate"
id: f39e438d-0ead-4272-9dde-d036e03fbfe3
description: 'Detection Strategy for Subvert Trust Controls via Install Root Certificate.. (Retargeted to the file_change auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: CertificatePaths, AdminAccounts.'
references:
  - https://attack.mitre.org/techniques/T1553/004
author: Shahrukh Khan
date: 2026-02-14
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1553.004

logsource:
  category: file_change
  product: linux

detection:
  selection:
    type: PATH
    nametype: CREATE
    name|contains: '/usr/local/share/ca-certificates/'
    name|endswith: '.crt'

  condition: selection

falsepositives:
  - Legitimate corporate root-CA installation by IT (common in enterprises with TLS-inspecting proxies); scope AdminAccounts to non-approved accounts performing the install.

level: high

T1553.004 Subvert Trust Controls: Install Root Certificate

title: "T1553.004 Subvert Trust Controls: Install Root Certificate"
id: ba547113-6c96-4807-a3bf-0472f59a9137
description: 'Detection Strategy for Subvert Trust Controls via Install Root Certificate.. (Retargeted to the file_change macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: MonitoredCommands, KeychainBaseline.'
references:
  - https://attack.mitre.org/techniques/T1553/004
author: Shahrukh Khan
date: 2026-02-09
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1553.004

logsource:
  category: file_change
  product: macos

detection:
  selection:
    Image|endswith:
      - '/security'
  selection_args:
    CommandLine|contains:
      - 'add-trusted-cert'
      - '-d -r trustRoot'
  condition: selection and selection_args

falsepositives:
  - Enterprise device management profiles and VPN or proxy software legitimately install root certificates through the same security command, so this should be correlated with whether the certificate installation was pushed by an approved MDM profile.

level: high

Related sub-techniques

Explore