From c3b8f12300f3c5d12b0bb92fd9ba6bd79d8df054 Mon Sep 17 00:00:00 2001
From: Oliver Kieselbach <oliver.kieselbach@outlook.com>
Date: Tue, 17 Mar 2026 22:43:17 +0100
Subject: [PATCH] fix community gather cert rule

---
 rules/gather/GATHER-ID-002.json | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/rules/gather/GATHER-ID-002.json b/rules/gather/GATHER-ID-002.json
index 15896045..ee02f699 100644
--- a/rules/gather/GATHER-ID-002.json
+++ b/rules/gather/GATHER-ID-002.json
@@ -10,7 +10,8 @@
   "enabled": true,
   "collectorType": "command_allowlisted",
   "target": "$c = Get-ChildItem Cert:\\LocalMachine\\My; if ($c) { $c | Select-Object Subject, Thumbprint, Issuer, NotBefore, NotAfter, HasPrivateKey | ConvertTo-Json } else { '{\"CertificateCount\": 0}' }",
-  "trigger": "startup",
+  "trigger": "phase_change",
+  "triggerPhase": "FinalizingSetup",
   "outputEventType": "gather_machine_cert_store",
   "outputSeverity": "Info",
   "tags": ["identity", "certificates", "machine-store", "powershell"]