Suspicious X509Enrollment Process Creation
Detects the use of X509Enrollment COM objects or their associated CLSID in process command lines. This can be indicative of attempts to manipulate certificates, potentially for defense evasion or to establish trust for malicious purposes, such as installing root certificates.
Sigma
