rules/linux/process_creation/lnx_install_root_certificate.yml

title: Install Root Certificate
id: 78a80655-a51e-4669-bc6b-e9d206a462ee
status: test
description: Detects installed new certificate
author: Ömer Günal, oscd.community
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1553.004/T1553.004.md
date: 2020/10/05
modified: 2021/11/27
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith:
      - '/update-ca-certificates'
      - '/update-ca-trust'
  condition: selection
falsepositives:
  - Legitimate administration activities
level: low
tags:
  - attack.defense_evasion
  - attack.t1553.004
Install Root Certificate 2020-10-05 20:21:20 +03:00			`title: Install Root Certificate`
			`id: 78a80655-a51e-4669-bc6b-e9d206a462ee`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`status: test`
update description 2020-10-05 20:22:43 +03:00			`description: Detects installed new certificate`
Update lnx_install_root_certificate.yml 2020-10-07 22:20:17 +03:00			`author: Ömer Günal, oscd.community`
Update lnx_install_root_certificate.yml 2020-11-08 11:06:11 +03:00			`references:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1553.004/T1553.004.md`
Install Root Certificate 2020-10-05 20:21:20 +03:00			`date: 2020/10/05`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`modified: 2021/11/27`
Install Root Certificate 2020-10-05 20:21:20 +03:00			`logsource:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`product: linux`
			`category: process_creation`
Install Root Certificate 2020-10-05 20:21:20 +03:00			`detection:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`selection:`
			`Image\|endswith:`
			`- '/update-ca-certificates'`
			`- '/update-ca-trust'`
			`condition: selection`
Install Root Certificate 2020-10-05 20:21:20 +03:00			`falsepositives:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`- Legitimate administration activities`
			`level: low`
			`tags:`
			`- attack.defense_evasion`
			`- attack.t1553.004`