CmdID

CmdID / PowerShell / Cmdlets / Import

Import-Certificate

Imports one or more certificates into a certificate store. Windows Server PowerShell reference

From the Windows Server PowerShell reference 4 parameters 1 Sigma rule looks for it Its page in the reference

Opens CmdID with your command, read as PowerShell. It is read in your browser and sent nowhere.

Parameters

4 in the Windows Server PowerShell reference
-CertStoreLocationSpecifies the path to the certificate store where the certificates will be imported.
-Confirm, -cfPrompts you for confirmation before running the cmdlet.
-FilePath, -FullNameSpecifies the path to a certificate file to be imported.
-WhatIf, -wiShows what would happen if the cmdlet runs.

What looks for it

Sigma process creation rules that name Import-Certificate
highRoot Certificate Installed From Susp LocationsNasreddine Bencherchali (Nextron Systems)