Rogue Root CA / Localcertificate.zip TLS Interception Payload

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•0

Detects the use of 'Localcertificate.zip' and associated PowerShell or certutil commands used to install a rogue root certificate authority into the Windows certificate store. This technique is often used by adversaries to enable TLS interception for credential and session theft.