Skip to content

Hide Navigation Hide TOC

Root Certificate Installed - PowerShell (42821614-9264-4761-acfc-5772c3286f76)

Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.

Cluster A Galaxy A Cluster B Galaxy B Level
Install Root Certificate - T1553.004 (c615231b-f253-4f58-9d47-d5b4cbdb6839) Attack Pattern Root Certificate Installed - PowerShell (42821614-9264-4761-acfc-5772c3286f76) Sigma-Rules 1
Subvert Trust Controls - T1553 (b83e166d-13d7-4b52-8677-dff90c548fd7) Attack Pattern Install Root Certificate - T1553.004 (c615231b-f253-4f58-9d47-d5b4cbdb6839) Attack Pattern 2