Windows Code Integrity: Blocked Driver Load Due to Revoked Certificate (Event ID 3023)
Flags Code Integrity Operational events where Windows blocks loading a revoked (untrusted) driver certificate.
- Product
- windows
- Service
- codeintegrity-operational
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-06-06
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows Code Integrity operational events where a driver load attempt is blocked because the driver certificate has been revoked. Attackers may rely on loading malicious or tampered drivers for persistence or privilege escalation, and revocation enforcement disrupts that. The detection relies on Code Integrity operational telemetry reporting Event ID 3023 for blocked driver loads.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations
- Internal ResearchInternal Research
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/code_integrity/win_codeintegrity_revoked_driver_blocked.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Code Integrity: Blocked Driver Load Due to Revoked Certificate (Event ID 3023)"
id: 4abcb059-5132-491f-815d-8cc80f1e01a9
status: test
description: This rule identifies Windows Code Integrity operational events where a driver load attempt is blocked because the driver certificate has been revoked. Attackers may rely on loading malicious or tampered drivers for persistence or privilege escalation, and revocation enforcement disrupts that. The detection relies on Code Integrity operational telemetry reporting Event ID 3023 for blocked driver loads.
references:
- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations
- Internal Research
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/code_integrity/win_codeintegrity_revoked_driver_blocked.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-06
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1543
logsource:
product: windows
service: codeintegrity-operational
detection:
selection:
EventID: 3023
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 9b72b82d-f1c5-4632-b589-187159bc6ec1
type: derived