Today I got an alert on my Elastic SIEM that sysmon.exe has modified or created a root certificate.

I tried to look for the certificate thumbprint in the Microsoft trusted root program and could not find it there.

Is this legitimate behavior ? Please note I have not updated sysmon.

Detection details

1 Answer 1


While we cannot ensure if this is a false positive, it does looks a bit suspicious, I would dig further on the thumbprint of the certificate.

You can follow this article that will guide you to inspect the binary blob with PowerShell to see if anything looks funky.

  • 1
    Thanks for sharing the article @raDiaSmO, I checked the hash of the running sysmon process, the path for sysmon etc and it seems legit, so it does not seem to be malware signed by a cloned cert.
    – termcap
    Dec 16, 2021 at 20:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .