Rogue root CA installation via certutil/security add-trusted-cert

Ibrahim Saud@tektrix

•updated Sep 17, 2026•2•0•4

Detects the installation of a potentially malicious root certificate on a host. The rule monitors for common command-line arguments used by 'certutil.exe' to add certificates to the store, use of the 'security' utility for certificate installation on macOS, and the execution of processes referencing 'Localcertificate.zip'.