New Root or CA or AuthRoot Certificate to Store

Title: New Root or CA or AuthRoot Certificate to Store
Status: test
Description:Detects the addition of new root, CA or AuthRoot certificates to the Windows registry
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md#atomic-test-6---add-root-certificate-to-currentuser-certificate-store
  -https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec
Author: frack113
Date: 2022-04-04
modified:2023-08-17
Tags:

• -'attack.impact'
• -'attack.t1490'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection:
    TargetObject|contains:
      -'\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates\'
      -'\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates\'
      -'\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\'
      -'\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\'
      -'\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates\'
      -'\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates\'
      -'\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\'
      -'\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot\Certificates\'
      -'\SOFTWARE\Microsoft\EnterpriseCertificates\AuthRoot\Certificates\'

    TargetObject|endswith: '\Blob'
    Details: 'Binary Data'
  condition:selection
Falsepositives:
  -Unknown
Level: medium