title: Install Root Certificate
id: 78a80655-a51e-4669-bc6b-e9d206a462ee
description: Detects installed new certificate
author: Ömer Günal, oscd.community
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1553.004/T1553.004.md
date: 2020/10/05
tags:
    - attack.defense_evasion
    - attack.t1553.004
level: low
logsource:
    product: linux
    category: process_creation
detection:
    selection:
         Image|endswith:
          - '/update-ca-certificates'
          - '/update-ca-trust'
    condition: selection
falsepositives:
    - Legitimate administration activities