Windows Code Integrity blocks image load when signing certificate is revoked (Event ID 3036)
Alerts on Windows Code Integrity Event ID 3036 when image loads are blocked because the signing certificate is revoked.
FreeReviewedSigma · High · v2
- Product
- windows
- Service
- codeintegrity-operational
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-06-06
- Updated
- 2026-07-31
What it detects
This rule flags Windows Code Integrity operational events where an image load is blocked because the signing certificate for the target file was revoked. Attackers may rely on revoked or otherwise untrusted binaries to introduce malicious code; blocking these loads helps prevent execution. The detection relies on Windows Code Integrity operational telemetry capturing Event ID 3036 and the associated blocked-image message.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations
- Internal ResearchInternal Research
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/code_integrity/win_codeintegrity_revoked_image_blocked.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-code-integrity-blocked-file-image-load-due-to-revoked-signing-certificat-6f156c48
title: Windows Code Integrity blocks image load when signing certificate is revoked (Event ID 3036)
id: 15193705-e26b-475c-9573-bb394af3cc9b
status: test
description: This rule flags Windows Code Integrity operational events where an image load is blocked because the signing certificate for the target file was revoked. Attackers may rely on revoked or otherwise untrusted binaries to introduce malicious code; blocking these loads helps prevent execution. The detection relies on Windows Code Integrity operational telemetry capturing Event ID 3036 and the associated blocked-image message.
references:
- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations
- Internal Research
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/code_integrity/win_codeintegrity_revoked_image_blocked.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-06
tags:
- attack.privilege-escalation
logsource:
product: windows
service: codeintegrity-operational
detection:
selection:
EventID: 3036
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 6f156c48-3894-4952-baf0-16193e9067d2
type: derived