New Root, CA, or AuthRoot Certificate Added to Windows Registry
Detects the addition of new root, CA, or AuthRoot certificates to the Windows registry. Adversaries may install root certificates to subvert trust controls, allowing them to avoid warnings when connecting to adversary-controlled web servers or to sign malicious code that bypasses signature validation. This rule specifically looks for modifications to the 'Certificates' subkeys under 'Root', 'CA', or 'AuthRoot' paths within 'SOFTWARE\Microsoft\SystemCertificates', 'SOFTWARE\Policies\Microsoft\SystemCertificates', or 'SOFTWARE\Microsoft\EnterpriseCertificates' hives, where the 'TargetObject' ends with '\Blob' and 'Details' is 'Binary Data'.
Sigma
