PowerShell Bypass running Block-EmudhraCompromisedCA or Disallowed store import
Detects execution of a specific PowerShell remediation script using execution policy bypass, or generic PowerShell activity importing certificates into the LocalMachine\Disallowed store outside of known administrator processes and accounts.
Microsoft Sentinel (KQL)
