T1553.004sub-technique of T1553 Subvert Trust Controls
Install Root Certificate
Linux · macOS · Windowsnothing on this site yetT1553.004 on attack.mitre.org
Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Ransomware, suspected or confirmed
Files renamed or unreadable, a ransom note, or backup deletion commands seen.
how MITRE says to see it
Detection Strategy for Subvert Trust Controls via Install Root Certificate.
- Detection of unauthorized modifications to Windows root certificate stores by monitoring registry keys, certificate installation processes, and creation of new certificate entries not in baseline trusted lists.
- Detection of unexpected additions or modifications to system-wide certificate stores or execution of commands adding certificates to trusted stores.
- Detection of malicious certificate installation via monitoring execution of the `security add-trusted-cert` command and modifications to system keychains.
what reduces it
- M1028 Operating System Configuration. Windows Group Policy can be used to manage root certificates and the `Flags` value of `HKLM\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\ProtectedRoots` can be set to 1 to prevent non-administrator users from making further root installations into their own HKCU certificate store.
- M1054 Software Configuration. HTTP Public Key Pinning (HPKP) is one method to mitigate potential Adversary-in-the-Middle situations where and adversary uses a mis-issued or fraudulent certificate to intercept encrypted communications by enforcing use of an expected certificate.