Windows Code Integrity: Revoked Image Loaded Events 3032/3035

title: "Windows Code Integrity: Revoked Image Loaded Events 3032/3035"
id: 425c2150-f7cf-45dd-aa4c-e79620fb7873
status: test
description: This rule flags Windows Code Integrity operational events where a revoked signed image is loaded into the system. Such activity matters because loading revoked binaries can indicate policy bypasses, tampering, or debug-assisted exceptions that allow untrusted code to execute. It relies on Code Integrity operational telemetry capturing EventID 3032 (revoked image loaded) and EventID 3035 (revoked image loaded while a kernel mode debugger is attached).
references:
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/code_integrity/win_codeintegrity_revoked_image_loaded.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-06
tags:
  - attack.privilege-escalation
logsource:
  product: windows
  service: codeintegrity-operational
detection:
  selection:
    EventID:
      - 3032
      - 3035
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 881b7725-47cc-4055-8000-425823344c59
    type: derived