Windows Code Integrity blocked disallowed file for protected processes (Event ID 3104)
Alerts on Windows Code Integrity Event ID 3104 when a disallowed file is blocked for protected processes.
FreeReviewedSigma · High · v2
- Product
- windows
- Service
- codeintegrity-operational
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-06-06
- Updated
- 2026-07-31
What it detects
This rule flags Windows Code Integrity block events where a file is denied because it is disallowed for protected processes. Such blocking is significant because it prevents execution of binaries that do not meet the protection policy, which attackers may try to bypass via unauthorized or untrusted executables. The detection relies on Code Integrity operational logs capturing Event ID 3104, including the blocked-file context.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations
- Internal ResearchInternal Research
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/code_integrity/win_codeintegrity_blocked_protected_process_file.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-code-integrity-blocked-disallowed-file-for-protected-processes-event-id--5daf11c3
title: Windows Code Integrity blocked disallowed file for protected processes (Event ID 3104)
id: 2042d844-8800-4ddc-9122-b3ed111e3da8
status: test
description: This rule flags Windows Code Integrity block events where a file is denied because it is disallowed for protected processes. Such blocking is significant because it prevents execution of binaries that do not meet the protection policy, which attackers may try to bypass via unauthorized or untrusted executables. The detection relies on Code Integrity operational logs capturing Event ID 3104, including the blocked-file context.
references:
- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations
- Internal Research
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/code_integrity/win_codeintegrity_blocked_protected_process_file.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-06
tags:
- attack.privilege-escalation
logsource:
product: windows
service: codeintegrity-operational
detection:
selection:
EventID: 3104
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 5daf11c3-022b-4969-adb9-365e6c078c7c
type: derived