New Root or CA or AuthRoot Certificate to Store — Detection Rule

Detects the addition of new root, CA or AuthRoot certificates to the Windows registry

Read the full analysis on IntelFusions