TA0005 · DEFENSE EVASION
Install Root Certificate
Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA).
Detect it with
A system's root certificates are unlikely to change frequently. Monitor new certificates installed on a system that could be due to malicious activity.
Why it matters on shift
Install Root Certificate is one of the concrete ways adversaries achieve defense evasion. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After defense evasion, the next tactic is usually Credential Access. Search your telemetry for the transition before closing the ticket.
Kill-chain context