Linux Custom CA Modifications
This rule detects attempts to install custom Certificate Authority (CA) certificates on Linux systems using common utilities. Adversaries may install root certificates to subvert trust controls, allowing them to intercept encrypted traffic or sign malicious code without triggering security warnings. The rule specifically looks for these utilities being used to interact with common CA certificate directories, while excluding a placeholder for legitimate custom CA installations depending on your environment.
CQL
