Linux Root Certificate Installation
Detects the installation of new root certificates on a Linux system. Attackers may install root certificates to bypass security warnings when connecting to adversary-controlled web servers or C2 infrastructure, making their malicious traffic appear legitimate. This rule specifically looks for the execution of common Linux utilities used for managing CA certificates: 'update-ca-certificates' and 'update-ca-trust'.
Sigma
