Windows Code Integrity: Blocked Image/Driver Load Due to Signing Level or Policy Violation

title: "Windows Code Integrity: Blocked Image/Driver Load Due to Signing Level or Policy Violation"
id: 11771a1a-cc9b-4f61-a918-1a54d6b89958
status: test
description: This rule flags Windows Code Integrity operational events where an attempted image or driver load was blocked because the file did not satisfy the required Authenticode signing level or violated a configured code integrity policy. Attackers may rely on loading unauthorized or improperly signed binaries/drivers to establish persistence or escalate privileges, and these blocks provide high-signal evidence of that activity. It relies on Code Integrity operational telemetry, matching Event ID 3077 that reports the targeted load attempt, signing level requirement, and the policy context.
references:
  - https://twitter.com/wdormann/status/1590434950335320065
  - https://github.com/MicrosoftDocs/windows-itpro-docs/blob/40fe118976734578f83e5e839b9c63ae7a4af82d/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md#windows-codeintegrity-operational-log
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/code_integrity/win_codeintegrity_enforced_policy_block.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-11-10
modified: 2023-06-07
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1543
logsource:
  product: windows
  service: codeintegrity-operational
detection:
  selection:
    EventID: 3077
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: e4be5675-4a53-426a-8c81-a8bb2387e947
    type: derived