ApolloShadow certutil root CA install and Firefox enterprise-roots trust for TLS stripping
Detects the installation of an attacker-controlled root certificate into the Windows certificate store using certutil.exe. This activity is correlated with the modification of Firefox browser settings to trust the Windows OS certificate store, an action often performed to facilitate TLS interception and traffic stripping.
Microsoft Sentinel (KQL)
