Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
64 detections
Filters
Last updated
All Time
Detection languages
38
9
5
4
3
Contributors
21
15
10
4
3
Categories
29
21
11
8
8
Platforms
50
7
6
5
Products / Services
12
12
6
6
5
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
4
IDS Protocols
3
1
Hunts DeviceFileCertificateInfo for files signed by certificates issued by the eight eMudhra (and eight Sectigo) intermediate CAs with compromised weak keys. It matches on issuer hash, issuer name and CA serial, with an optional broader eMudhra/emSign match.
Detects modifications to Certificate Authority (CA) trust stores, configuration files, or blocklists on Linux and macOS endpoints, followed by trust store update commands within a 30-minute window.
Detects execution of a specific PowerShell remediation script using execution policy bypass, or generic PowerShell activity importing certificates into the LocalMachine\Disallowed store outside of known administrator processes and accounts.
The following analytic detects the installation of a root CA certificate by monitoring specific registry paths for SetValue events. It leverages data from the Endpoint datamodel, focusing on registry paths containing "certificates" and registry values named "Blob." This activity is significant because unauthorized root CA certificates can compromise the integrity of encrypted communications and facilitate man-in-the-middle attacks. If confirmed malicious, this could allow an attacker to intercept, decrypt, or manipulate sensitive data, leading to severe security breaches.
Detects installation of new certificate on the system which attackers may use to avoid warnings when connecting to controlled web servers or C2s
Detects the MSBuild.exe process adding new root or intermediate certificate authorities to the Windows certificate stores. This activity is indicative of potential malicious PKI infrastructure staging, which can be used to facilitate adversary-in-the-middle (AiTM) attacks or bypass certificate validation.
Detects the presence and execution of components related to the 'GhostCode' activity, specifically the installation of a rogue self-signed root certificate authority (CA) masquerading as Google Trust Services and the subsequent configuration of a local TLS-intercepting proxy. The detection monitors for the creation of specific archive files, modification of the system certificate store, addition of local firewall rules, and modification of the local hosts file.
This rule detects a suspicious sequence of events occurring on a host within a 600-second window: the modification of the Windows Trusted Root Certificate store (via certutil or registry manipulation) followed by the writing of a new executable file. This behavior is indicative of an adversary establishing persistence or preparing to bypass security controls by installing a malicious CA certificate and dropping a packed binary.
Detects the use of certutil.exe to add a certificate to the root store. Adversaries may perform this action to establish persistence or facilitate interception of encrypted traffic by adding a malicious CA certificate to the trusted root store.
Detects the installation of a potentially malicious root certificate on a host. The rule monitors for common command-line arguments used by 'certutil.exe' to add certificates to the store, use of the 'security' utility for certificate installation on macOS, and the execution of processes referencing 'Localcertificate.zip'.
Detects the installation of a rogue root certificate into the operating system's trust store. This is a common technique used by adversaries to perform TLS/SSL interception (Adversary-in-the-Middle) by establishing a chain of trust for malicious proxy traffic. The rule identifies suspicious use of Windows 'certutil' to add certificates to the 'Root' store, macOS keychain certificate management commands, and indicators associated with 'Localcertificate.zip' payloads.
This rule detects potentially unauthorized installation of root certificates on Windows and macOS systems. Attackers use this technique to bypass security warnings, establish adversary-in-the-middle capabilities, or inspect encrypted traffic by adding their own certificates to the system's trust store.
Detects the use of 'Localcertificate.zip' and associated PowerShell or certutil commands used to install a rogue root certificate authority into the Windows certificate store. This technique is often used by adversaries to enable TLS interception for credential and session theft.
Detects the download of a JavaScript module named JSCeal, which contains code indicative of an HTTPS interception proxy. The rule looks for Node.js-based server creation code combined with cryptographic operations like keypair generation, certificate creation, and PEM conversion, excluding common legitimate JavaScript libraries and CDNs.
Detects the download of a JavaScript module named JSCeal, which contains code indicative of an HTTPS interception proxy. The rule looks for Node.js-based server creation code combined with cryptographic operations like keypair generation, certificate creation, and PEM conversion, excluding common legitimate JavaScript libraries and CDNs.
Detects the installation of an attacker-controlled root certificate into the Windows certificate store using certutil.exe. This activity is correlated with the modification of Firefox browser settings to trust the Windows OS certificate store, an action often performed to facilitate TLS interception and traffic stripping.
This rule detects the use of the 'SecTrustSetAnchorCertificatesOnly' macOS Security framework API call. This API is used to restrict trust to only the anchor certificates provided, which is a technique often used by malware or malicious scripts to bypass security trust controls, intercept TLS/SSL traffic, or facilitate adversary-in-the-middle attacks.
Detects execution of macOS.Gaslight malware by identifying specific function calls within process command lines, specifically 'SecTrustSetAnchorCertificatesOnly' for certificate pinning, 'SCDynamicStoreCopyProxies' for proxy awareness, and 'CCRandomGenerateBytes' for cryptographical operations. These behaviors are typical of the implant's efforts to maintain encrypted C2 communication while frustrating network inspection tools.
This rule detects attempts to install custom Certificate Authority (CA) certificates on Linux systems using common utilities. Adversaries may install root certificates to subvert trust controls, allowing them to intercept encrypted traffic or sign malicious code without triggering security warnings. The rule specifically looks for these utilities being used to interact with common CA certificate directories, while excluding a placeholder for legitimate custom CA installations depending on your environment.
Detects installation of root certificates to enable MITM interception
This rule detects the installation of a root certificate via an HTTP response. It specifically looks for HTTP traffic flowing from the server to the client (to_client, established) where the URI contains ".cer" (case-insensitive) and the file data contains the string "-----BEGIN CERTIFICATE-----". This combination suggests a certificate file being delivered over HTTP, which could be indicative of a malicious root certificate installation attempt, often used in man-in-the-middle attacks or to establish persistence for malware.
Page 1 of 4