New Root or CA or AuthRoot Certificate to Store (d223b46b-5621-4037-88fe-fda32eead684)
Detects the addition of new root, CA or AuthRoot certificates to the Windows registry
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Inhibit System Recovery - T1490 (f5d8eed6-48a9-4cdf-a3d7-d1ffa99c3d2a) | Attack Pattern | New Root or CA or AuthRoot Certificate to Store (d223b46b-5621-4037-88fe-fda32eead684) | Sigma-Rules | 1 |