Install Root Certificate — Detection Rule

Detects installation of new certificate on the system which attackers may use to avoid warnings when connecting to controlled web servers or C2s

Read the full analysis on IntelFusions