type: attack-pattern
spec_version: 2.1
id: attack-pattern--d519cfd5-f3a8-43a9-a846-ed0bb40672b1
created: 2017-05-31T21:31:42.750Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: yes
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1130
external_id: T1130
source_name: capec
url: https://capec.mitre.org/data/definitions/479.html
external_id: CAPEC-479
source_name: Wikipedia Root Certificate
description: Wikipedia. (2016, December 6). Root certificate. Retrieved February 20, 2017.
url: https://en.wikipedia.org/wiki/Root_certificate
source_name: Operation Emmental
description: Sancho, D., Hacquebord, F., Link, R. (2014, July 22). Finding Holes Operation Emmental. Retrieved February 9, 2016.
url: http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-finding-holes-operation-emmental.pdf
source_name: Kaspersky Superfish
description: Onuma. (2015, February 24). Superfish: Adware Preinstalled on Lenovo Laptops. Retrieved February 20, 2017.
url: https://www.kaspersky.com/blog/lenovo-pc-with-adware-superfish-preinstalled/7712/
source_name: SpectorOps Code Signing Dec 2017
description: Graeber, M. (2017, December 22). Code Signing Certificate Cloning Attacks and Defenses. Retrieved April 3, 2018.
url: https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec
source_name: objective-see ay mami 2018
description: Patrick Wardle. (2018, January 11). Ay MaMi. Retrieved March 19, 2018.
url: https://objective-see.com/blog/blog_0x26.html
source_name: Microsoft Sigcheck May 2017
description: Russinovich, M. et al.. (2017, May 22). Sigcheck. Retrieved April 3, 2018.
url: https://docs.microsoft.com/sysinternals/downloads/sigcheck
source_name: Tripwire AppUNBlocker
description: Smith, T. (2016, October 27). AppUNBlocker: Bypassing AppLocker. Retrieved December 19, 2017.
url: https://www.tripwire.com/state-of-security/off-topic/appunblocker-bypassing-applocker/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:27.671Z
name: Install Root Certificate
description: Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate. (Citation: Wikipedia Root Certificate) Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.

Installation of a root certificate on a compromised system would give an adversary a way to degrade the security of that system. Adversaries have used this technique to avoid security warnings prompting users when compromised systems connect over HTTPS to adversary controlled web servers that spoof legitimate websites in order to collect login credentials. (Citation: Operation Emmental)

Atypical root certificates have also been pre-installed on systems by the manufacturer or in the software supply chain and were used in conjunction with malware/adware to provide a man-in-the-middle capability for intercepting information transmitted over secure TLS/SSL communications. (Citation: Kaspersky Superfish)

Root certificates (and their associated chains) can also be cloned and reinstalled. Cloned certificate chains will carry many of the same metadata characteristics of the source and can be used to sign malicious code that may then bypass signature validation tools (ex: Sysinternals, antivirus, etc.) used to block execution and/or uncover artifacts of Persistence. (Citation: SpectorOps Code Signing Dec 2017)

In macOS, the Ay MaMi malware uses /usr/bin/security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /path/to/malicious/cert to install a malicious certificate as a trusted root certificate into the system keychain. (Citation: objective-see ay mami 2018)
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: defense-evasion
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Itzik Kotler, SafeBreach
Travis Smith, Tripwire
Red Canary
Matt Graeber, @mattifestation, SpecterOps
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Linux
Windows
macOS
x_mitre_version: 1.1