Process spawned unexpected child process

This typically indicates the parent process was compromised via an exploit or macro.

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Run Powershell and hide display window.

Modifies trusted root certificate store through registry

A root certificate was added, modified, or removed in the trusted certificate store registry paths.