Root Certificate Pushed via Remote Registry

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects attempts to push a root certificate to a Windows system via the Remote Registry service (SMB port 445). It specifically looks for network traffic containing the strings "Root\Certificates" and "RegSetValue" (case-insensitive) within the same TCP flow to a server on port 445. This activity could indicate an attacker attempting to establish persistence or bypass security controls by installing a trusted root certificate.