Linux/macOS CA trust store edits to distrust CAs (eMudhra workaround)
Detects modifications to Certificate Authority (CA) trust stores, configuration files, or blocklists on Linux and macOS endpoints, followed by trust store update commands within a 30-minute window.
Microsoft Sentinel (KQL)

