If you can dump the memory holding security certificates, I'd suggest you probably can. There will be processes outside a users control that run with elevated

If you can dump the memory holding security certificates, I'd suggest you probably can. There will be processes outside a users control that run with elevated privileges, attacks that allow you to monitor the setup of these processes could prove risky to the overall security of a system.