Rogue Root CA Installation for Local HTTPS Interception

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•2

This rule detects potentially unauthorized installation of root certificates on Windows and macOS systems. Attackers use this technique to bypass security warnings, establish adversary-in-the-middle capabilities, or inspect encrypted traffic by adding their own certificates to the system's trust store.