DSCourier Rogue Root Cert Import via Import-Certificate Targeting LocalMachine Root

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects suspicious certificate installation or modification in the 'Root' or 'TrustedPeople' stores by PowerShell or certutil.exe. This activity is analyzed in the context of common management tools (e.g., winget) or shell environments, which may indicate an attacker attempting to establish persistence or facilitate man-in-the-middle attacks by injecting malicious root certificates.