AN0153
Analytic 0153
Windows
Detection of unauthorized modifications to Windows root certificate stores by monitoring registry keys, certificate installation processes, and creation of new certificate entries not in baseline trusted lists.
WinEventLog:Security
EventCode=4657
WinEventLog:Sysmon
EventCode=12
WinEventLog:Sysmon
EventCode=1
[TrustedRootHashList]
Baseline list of root certificate hashes; defenders can tune based on organizational certificate policies.
[MonitoredProcesses]
Processes associated with certificate management that should be flagged if executed by non-admin users or in unusual contexts.
[TimeWindow]
Correlation window for registry modifications, certificate installation, and process creation to strengthen detection.
AN0154
Analytic 0154
Linux
Detection of unexpected additions or modifications to system-wide certificate stores or execution of commands adding certificates to trusted stores.
auditd:SYSCALL
open, write: File modifications under /etc/ssl/certs, /usr/local/share/ca-certificates, or /etc/pki/ca-trust/source/anchors
auditd:EXECVE
execve: Execution of update-ca-certificates or trust anchor modification commands
[CertificatePaths]
Paths monitored for certificate modifications; can be tuned depending on Linux distribution.
[AdminAccounts]
Expected user accounts with privileges to install root certificates; anomalies outside this context are suspicious.
AN0155
Analytic 0155
macOS
Detection of malicious certificate installation via monitoring execution of the `security add-trusted-cert` command and modifications to system keychains.
macos:unifiedlog
Execution of /usr/bin/security add-trusted-cert or keychain modifications to System.keychain
macos:osquery
query: Enumeration of root certificates showing unexpected additions
[MonitoredCommands]
Commands related to certificate management (e.g., security, profiles) that can be tuned per environment.
[KeychainBaseline]
Baseline of expected certificates in System.keychain to reduce false positives from legitimate enterprise certificates.