Windows Code Integrity: Blocked File Image Load Due to Revoked Signing Certificate (Event ID 3036)

title: "Windows Code Integrity: Blocked File Image Load Due to Revoked Signing Certificate (Event ID 3036)"
id: 15193705-e26b-475c-9573-bb394af3cc9b
status: test
description: This rule flags Windows Code Integrity events where the OS blocks an image load because the signing certificate for the file has been revoked. Attackers may attempt to execute or load tampered or illegitimate signed components; revocation-based blocking is a strong indicator that such content was denied. The detection relies on CodeIntegrity operational telemetry reporting Event ID 3036 with the integrity verification failure due to a revoked certificate.
references:
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/code_integrity/win_codeintegrity_revoked_image_blocked.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-06
tags:
  - attack.privilege-escalation
logsource:
  product: windows
  service: codeintegrity-operational
detection:
  selection:
    EventID: 3036
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 6f156c48-3894-4952-baf0-16193e9067d2
    type: derived