New Root Certificate Installed Via Certutil.EXE
Detects the execution of 'certutil.exe' with the '-addstore' flag and 'root' in the command line, indicating an attempt to install a new root certificate on the system. Adversaries may use this technique to establish trust for their own certificates, bypassing security warnings when connecting to adversary-controlled web servers or for code signing.
Sigma
