DSCourier Attacker Cert Import into LocalMachine Root Certificate Store

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

This rule detects activities associated with the DSCourier technique, specifically the unauthorized installation of root certificates. It monitors for PowerShell commands importing certificates into the Root store, the use of insecure curl downloads of certificate files, and unauthorized process access to the Windows Root certificate registry hive.