> For the complete documentation index, see [llms.txt](https://www.ired.team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.ired.team/offensive-security/persistence/t1130-install-root-certificate.md).

# Installing Root Certificate

## Execution

Adding a certificate with a native windows binary:

{% code title="attacker\@victim" %}

```csharp
certutil.exe -addstore -f -user Root C:\Users\spot\Downloads\certnew.cer
```

{% endcode %}

![](/files/-LJyqMckKQO2kEqqc1UV)

Checking to see the certificate got installed:

![](/files/-LJyqQ2VqLB4JYJDrAnZ)

Adding the certificate with powershell:

{% code title="attacker\@victim" %}

```csharp
Import-Certificate -FilePath C:\Users\spot\Downloads\certnew.cer -CertStoreLocation Cert:\CurrentUser\Root\
```

{% endcode %}

![](/files/-LJyqbycoKnz6uhQe5WO)

## Observations

Advanced poweshell logging to the rescue:

![](/files/-LJyqg-QzrDfu7RLZY3p)

Commandline logging:

![](/files/-LJyr4S1zYBs87IneLGr)

The CAs get installed to:

```csharp
Computer\HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates\C6B22A75B0633E76C9F21A81F2EE6E991F5C94AE
```

..so it is worth monitoring registry changes there:

![](/files/-LJz3Pa7Z4DINdAebLKM)

## References

{% embed url="<https://attack.mitre.org/wiki/Technique/T1130>" %}