eMudhra Intermediate CA Key Compromise: Emergency Certificate Distrust — Detection and Remediation Guide

---
title: Certificate Added to Trusted Root or CA Store via Certutil
description: Detects certutil being used to add a certificate to the LocalMachine or CurrentUser trusted Root or CA stores. Attackers with fraudulently issued certificates (e.g., from the compromised eMudhra intermediates) may install them locally to persist TLS interception.
id: 3f7b2c91-4a6e-4d18-9c25-8e1f0a5b7d33
status: experimental
references:
  - https://attack.mitre.org/techniques/T1553/004/
  - https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html
author: Security Arsenal
date: 2026/10/21
tags:
  - attack.defense_evasion
  - attack.t1553.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: '\certutil.exe'
  selection_add:
    CommandLine|contains:
      - '-addstore'
      - '-AddStore'
  selection_store:
    CommandLine|contains:
      - ' Root '
      - ' CA '
      - '"Root"'
      - '"CA"'
      - ' AuthRoot'
      - ' ROOT'
  condition: selection_img and selection_add and selection_store
falsepositives:
  - Enterprise PKI administrators deploying internal root certificates
  - Software installers registering vendor signing roots
level: high
---
title: Certificate Installed to Trusted Store via PowerShell
description: Detects PowerShell cmdlets importing a certificate into trusted Root, CA, or AuthRoot stores. Relevant to adversaries operationalizing certificates forged with the compromised eMudhra intermediate keys.
id: 9c4e1a76-2b8f-4d53-a671-0d3f8e2b6a14
status: experimental
references:
  - https://attack.mitre.org/techniques/T1553/004/
  - https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html
author: Security Arsenal
date: 2026/10/21
tags:
  - attack.defense_evasion
  - attack.t1553.004
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmdlet:
    CommandLine|contains:
      - 'Import-Certificate'
      - 'New-SelfSignedCertificate'
  selection_store:
    CommandLine|contains:
      - 'Cert:\LocalMachine\Root'
      - 'Cert:\LocalMachine\CA'
      - 'Cert:\LocalMachine\AuthRoot'
      - 'Cert:\CurrentUser\Root'
  condition: all of selection_*
falsepositives:
  - Internal CA enrollment scripts
  - MDM/Intune certificate provisioning
level: high
---
title: Trusted Root Certificate Store Registry Modification
description: Detects direct registry writes under the Windows system certificate stores for Root, CA, or AuthRoot, bypassing certutil and certificate APIs. A forged certificate installed this way survives casual inspection and indicates deliberate tampering.
id: 5d1a8f42-7c39-4e26-b854-1f9a3c7d2e60
status: experimental
references:
  - https://attack.mitre.org/techniques/T1553/004/
  - https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html
author: Security Arsenal
date: 2026/10/21
tags:
  - attack.defense_evasion
  - attack.t1553.004
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
      - '\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates\'
      - '\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\'
      - '\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\'
  filter_known:
    Image|endswith:
      - '\svchost.exe'
      - '\lsass.exe'
  condition: selection and not filter_known
falsepositives:
  - Group Policy certificate deployment (typically via svchost, filtered above)
  - Endpoint management agents pushing enterprise roots
level: high

// Hunt 1: Endpoint trust-store tampering (certutil / PowerShell / Import-Certificate)
// Any hit here warrants investigation in the context of the eMudhra key compromise.
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where (
    (FileName =~ "certutil.exe" and ProcessCommandLine has_any ("-addstore", "-AddStore")
        and ProcessCommandLine has_any ("Root", "AuthRoot", " CA "))
    or
    (ProcessCommandLine has "Import-Certificate"
        and ProcessCommandLine has_any ("Cert:\\LocalMachine\\Root", "Cert:\\LocalMachine\\CA", "Cert:\\CurrentUser\\Root", "AuthRoot"))
  )
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessAccountName, SHA256
| order by TimeGenerated desc

// Hunt 2: TLS sessions presenting certificates issued by eMudhra intermediates.
// Assumes Zeek/Suricata/firewall TLS metadata ingested via CommonSecurityLog or Syslog.
// Tune the field names to your source: Zeek ssl.log 'issuer' often arrives in Message or a custom field.
CommonSecurityLog
| where TimeGenerated > ago(30d)
| where Message contains "eMudhra" or AdditionalExtensions contains "eMudhra"
| extend Issuer = tostring(extract(@"(?i)issuer[^=]*=([^;|]+)", 1, Message))
| project TimeGenerated, SourceIP, DestinationIP, DestinationHostName, Issuer, Message
| order by TimeGenerated desc

// Hunt 3: Identify endpoints still talking TLS to hosts whose cert chain may be forged -
// baseline new/never-before-seen remote hosts serving login or update-like names.
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemotePort == 443
| where RemoteUrl has_any ("login", "signin", "update", "download", "auth")
| summarize FirstSeen = min(TimeGenerated), Connections = count(), Devices = dcount(DeviceId) by RemoteUrl, RemoteIP
| where FirstSeen > ago(7d)
| order by FirstSeen asc

-- Hunt: Enumerate endpoint certificate stores for any certificate issued by eMudhra.
-- Finds both legitimately purchased certs (replacement candidates) and rogue installs.
-- Runs on Windows endpoints via PowerShell through execve.
LET store_scan = SELECT * FROM execve(
   argv=["powershell", "-NoProfile", "-NonInteractive", "-Command",
         "Get-ChildItem -Recurse Cert:\\LocalMachine, Cert:\\CurrentUser -ErrorAction SilentlyContinue | Where-Object { $_.Issuer -match 'eMudhra' -or $_.Subject -match 'eMudhra' } | Select-Object PSParentPath, Subject, Issuer, Thumbprint, NotAfter | ConvertTo-Json -Compress"]
)
SELECT Hostname,
       Stdout AS MatchingCertificates,
       timestamp(epoch=now()) AS CollectionTime
FROM store_scan
WHERE MatchingCertificates =~ 'eMudhra'

# eMudhra Intermediate CA Compromise - Endpoint Audit and Distrust Enforcement
# Run elevated. Produces an inventory, then optionally distrusts matching intermediates.
# Replace thumbprints below with the eight affected intermediates once published
# in the Mozilla / Chrome Root Program advisories.

$AuditPath = "$env:ProgramData\eMudhra-Audit-$(Get-Date -Format yyyyMMdd-HHmmss).csv"

# Step 1: Inventory every certificate in machine and user stores chaining to eMudhra
$matches = Get-ChildItem -Recurse Cert:\LocalMachine, Cert:\CurrentUser -ErrorAction SilentlyContinue |
    Where-Object { $_.Issuer -match 'eMudhra' -or $_.Subject -match 'eMudhra' } |
    Select-Object @{n='Store';e={$_.PSParentPath -replace '^.*::',''}}, Subject, Issuer, Thumbprint, NotBefore, NotAfter

$matches | Export-Csv -Path $AuditPath -NoTypeInformation
Write-Host "[*] $($matches.Count) eMudhra-related certificate(s) found. Inventory: $AuditPath"

# Step 2: Explicitly distrust the compromised intermediates (populate from vendor advisory)
$CompromisedThumbprints = @(
    # 'THUMBPRINT_1_FROM_MOZILLA_ADVISORY',
    # 'THUMBPRINT_2_FROM_MOZILLA_ADVISORY'
    # ... add all eight once published
)
foreach ($tp in $CompromisedThumbprints) {
    $cert = Get-Item "Cert:\LocalMachine\*\$tp" -ErrorAction SilentlyContinue
    if ($cert) {
        certutil.exe -addstore -f Disallowed $tp | Out-Null
        Write-Host "[+] Thumbprint $tp added to Disallowed store"
    } else {
        Write-Host "[-] Thumbprint $tp not present locally"
    }
}

# Step 3: Verify browser distrust components are updating (Chrome CRLSet / Firefox OneCRL ship via update)
$chrome = (Get-Item "${env:ProgramFiles(x86)}\Google\Chrome\Application\chrome.exe" -ErrorAction SilentlyContinue).VersionInfo.ProductVersion
$edge   = (Get-Item "${env:ProgramFiles(x86)}\Microsoft\Edge\Application\msedge.exe" -ErrorAction SilentlyContinue).VersionInfo.ProductVersion
Write-Host "[*] Chrome: $chrome | Edge: $edge -- confirm against the emergency-fix build numbers in vendor advisories"

# Step 4: Flag anything already sitting in Disallowed for reporting
Get-ChildItem Cert:\LocalMachine\Disallowed -ErrorAction SilentlyContinue |
    Select-Object Subject, Thumbprint | Format-Table -AutoSize

# Scan common Linux truststore and TLS-terminator locations for eMudhra-issued certs
for f in $(find /etc/ssl /etc/pki /usr/local/share/ca-certificates /etc/nginx /etc/apache2 /etc/haproxy -type f \( -name '*.pem' -o -name '*.crt' -o -name '*.cer' \) 2>/dev/null); do
  issuer=$(openssl x509 -in "$f" -noout -issuer 2>/dev/null)
  case "$issuer" in
    *eMudhra*) echo "MATCH: $f -> $issuer" ;;
  esac
done

# Audit the live chain of your own public services from an external vantage point
echo | openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | openssl x509 -noout -issuer -subject -dates

# Java application truststores are a classic blind spot
keytool -list -cacerts -storepass changeit 2>/dev/null | grep -i emudhra