Skip to content

Install Root Certificate

Subtechnique · ATTACK:enterprise:T1553.004

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1553.004",
  "title": "Install Root Certificate",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1553/004",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--c615231b-f253-4f58-9d47-d5b4cbdb6839",
  "external_id": "T1553.004",
  "domain": "enterprise",
  "created": "2020-02-21T21:05:32.844Z",
  "modified": "2026-05-12T15:12:00.715Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [
    "defense-impairment"
  ],
  "source_references": [
    {
      "source_name": "Operation Emmental",
      "url": "https://www.youtube.com/watch?v=gchKFumYHWc"
    },
    {
      "source_name": "SpectorOps Code Signing Dec 2017",
      "url": "https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec"
    },
    {
      "source_name": "Kaspersky Superfish",
      "url": "https://www.kaspersky.com/blog/lenovo-pc-with-adware-superfish-preinstalled/7712/"
    },
    {
      "source_name": "objective-see ay mami 2018",
      "url": "https://objective-see.com/blog/blog_0x26.html"
    },
    {
      "source_name": "Wikipedia Root Certificate",
      "url": "https://en.wikipedia.org/wiki/Root_certificate"
    }
  ]
}

Explicit source assertions (8)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:M1054 → mitigates → ATTACK:enterprise:T1553.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2981e224-edec-454e-91da-5dcad30572c1

ATTACK:enterprise:S0160 → uses → ATTACK:enterprise:T1553.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--542bb806-3e73-42f5-8a3e-86b498093f4b

Palo Alto Retefe

ATTACK:enterprise:S0281 → uses → ATTACK:enterprise:T1553.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--97c225e6-64ad-42af-8cc4-4fb4deea39fc

hexed osx.dok analysis 2019 · objsee mac malware 2017

ATTACK:enterprise:S0009 → uses → ATTACK:enterprise:T1553.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9a78f409-0f6b-41fd-a18f-f38366e4703e

Sood and Enbody

ATTACK:enterprise:S9003 → uses → ATTACK:enterprise:T1553.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a2a81a97-a8ce-447b-9c8a-3029a96a7e65

Evilginx 2 July 2018

ATTACK:enterprise:T1553.004 → subtechnique-of → ATTACK:enterprise:T1553

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a33048dc-d843-497c-b8e0-048cc3a08ac7

ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1553.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--af74c0ec-0bbe-4538-a3a3-1e967afd3d51

ESET RTM Feb 2017 · Unit42 Redaman January 2019

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1553.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--afd15f23-1829-4d86-9d8b-cae915fe8596

SpectorOps Code Signing Dec 2017

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.