Attempt To Add Certificate To Untrusted Store
Hypothesis and description
Adversaries may add their own root certificate to the certificate store, to cause the web browser to trust that certificate and not display a security warning when it encounters the previously unseen certificate. This action may be the precursor to malicious activity.
- Platforms
- Windows
- Domain
- Analytic
- Subtypes
- Process
- Submitted
- 2021-05-11
- Contributors
- Splunk Threat Research <research@splunk.com>
ATT&CK coverage
| Technique | Tactics | Coverage |
|---|---|---|
| T1553 Subvert Trust ControlsT1553.004 | Stealth (formerly Defense Evasion) | Moderate |
1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.
D3FEND techniques MITRE maps to this analytic
Data model references
Fields from the CAR data model (object/action/field) the analytic reads.
Pseudocode and implementations
Pseudocode implementation of the splunk search below
processes = search Process:Create
addstore_commands = filter processes where (
exe =”C:\Windows\System32\certutil.exe” AND command_line="*-addstore*” )
output addstore_commandsYou must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.
| tstats count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=*certutil* (Processes.process=*-addstore*) by Processes.parent_process Processes.process_name Processes.userAcross MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.