Attempt To Add Certificate To Untrusted Store

This analytic detects attempts to add a certificate to the untrusted certificate store using the 'certutil -addstore' command. This activity is significant as it may indicate an attacker trying to disable security tools to gain unauthorized access. If confirmed malicious, this could lead to the compromise of system security, allowing attackers to bypass defenses and potentially escalate privileges or persist in the environment.