Root Certificate Installed From Suspicious Locations
This rule detects the installation of a root certificate from suspicious locations using PowerShell's `Import-Certificate` cmdlet. Adversaries may install root certificates to bypass security warnings when connecting to their controlled web servers, facilitating man-in-the-middle attacks or credential harvesting. The rule specifically looks for the `Import-Certificate` cmdlet targeting `Cert:\LocalMachine\Root` and originating from common temporary or user-writable directories like `AppData\Local\Temp\`, `Windows\TEMP\`, `Desktop\`, `Downloads\`, `Perflogs\`, or `Users\Public\`.
Sigma
