Windows Code Integrity blocks revoked driver loads (Event ID 3023)

title: Windows Code Integrity blocks revoked driver loads (Event ID 3023)
id: 4abcb059-5132-491f-815d-8cc80f1e01a9
status: test
description: This rule identifies blocked attempts to load a Windows driver whose signing certificate has been revoked. Attackers may rely on driver loading for persistence or privilege escalation, so certificate revocation blocks can disrupt malicious implants. The detection is based on Code Integrity Operational telemetry capturing Event ID 3023, which records the specific blocked driver load due to revocation.
references:
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/code_integrity/win_codeintegrity_revoked_driver_blocked.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-06
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1543
logsource:
  product: windows
  service: codeintegrity-operational
detection:
  selection:
    EventID: 3023
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 9b72b82d-f1c5-4632-b589-187159bc6ec1
    type: derived