System and method of detecting an unauthorized alteration in regards to a certificate store

A system for detecting unauthorized alteration with regard to a certificate store, comprising:

• at least one processor configured to:
• track changes in a file system or a system registry of an operating system of a device with regard to the certificate store;
• detect an alteration or an attempted alteration with regard to the certificate and send information about the alternation or the attempted alteration to an analysis module, when the alteration or the attempted alteration occurs;
• obtain information about at least one certificate with which a change in the file system or the system registry with regard to the certificate store is connected, and determine a class of the change, where the class of the change is determined from a portion of the respective system registry or the file system in which the change occurred and from an action associated with the change;
• and
• compare the obtained information about the at least one certificate to similar information on known certificates.

A non-transitory computer readable medium storing thereon computer executable instructions for detecting unauthorized alteration with regard to a certificate store, including instructions for:

• tracking changes in a file system or a system registry of an operating system of a device with regard to the certificate store;
• detecting an alteration or an attempted alteration with regard to the certificate and sending information about the alternation or the attempted alteration to an analysis module, when the alteration or the attempted alteration occurs;
• obtaining information about at least one certificate with which a change in the file system or the system registry with regard to the certificate store is connected, and determining a class of the change, where the class of the change is determined from a portion of the respective system registry or the file system in which the change occurred and from an action associated with the change;
• and
• comparing the obtained information about the at least one certificate to similar information on known certificates.