mirror of
https://github.com/valitydev/SigmaHQ.git
synced 2024-11-07 09:48:58 +00:00
48 lines
1.5 KiB
YAML
48 lines
1.5 KiB
YAML
action: global
|
|
title: Root Certificate Installed
|
|
id: 42821614-9264-4761-acfc-5772c3286f76
|
|
status: experimental
|
|
description: Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.
|
|
references:
|
|
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1553.004/T1553.004.md
|
|
author: 'oscd.community, @redcanary, Zach Stanford @svch0st'
|
|
date: 2020/10/10
|
|
tags:
|
|
- attack.defense_evasion
|
|
- attack.t1553.004
|
|
level: medium
|
|
falsepositives:
|
|
- Help Desk or IT may need to manually add a corporate Root CA on occasion. Need to test if GPO push doesn't trigger FP
|
|
detection:
|
|
condition: 1 of them
|
|
---
|
|
logsource:
|
|
product: windows
|
|
service: powershell
|
|
detection:
|
|
selection1:
|
|
EventID: 4104
|
|
ScriptBlockText|contains|all:
|
|
- 'Move-Item'
|
|
- 'Cert:\LocalMachine\Root'
|
|
selection2:
|
|
EventID: 4104
|
|
ScriptBlockText|contains|all:
|
|
- 'Import-Certificate'
|
|
- 'Cert:\LocalMachine\Root'
|
|
---
|
|
logsource:
|
|
category: process_creation
|
|
product: windows
|
|
detection:
|
|
selection1:
|
|
Image|endswith: '\certutil.exe' # Example: certutil -addstore -f -user ROOT CertificateFileName.der
|
|
CommandLine|contains|all:
|
|
- '-addstore'
|
|
- 'root'
|
|
selection2:
|
|
Image|endswith: '\CertMgr.exe' # Example: CertMgr.exe /add CertificateFileName.cer /s /r localMachine root /all
|
|
CommandLine|contains|all:
|
|
- '/add'
|
|
- 'root'
|