Windows Code Integrity: Revoked Signed Image Loaded (Event 3032/3035)
Alerts on Code Integrity events showing a revoked signed image was loaded, including debugger-allowed cases.
FreeReviewedSigma · High · v2
- Product
- windows
- Service
- codeintegrity-operational
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-06-06
- Updated
- 2026-07-31
What it detects
This rule identifies Windows Code Integrity operational events where a revoked signed image is loaded into the system. Such behavior matters because loading revoked binaries may allow an attacker to run code that is intended to be blocked, including scenarios where loading is permitted due to an attached kernel mode debugger. The detection relies on Code Integrity operational telemetry reporting EventID 3032 and 3035.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations
- Internal ResearchInternal Research
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/code_integrity/win_codeintegrity_revoked_image_loaded.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-code-integrity-revoked-image-loaded-events-3032-3035-881b7725
title: "Windows Code Integrity: Revoked Signed Image Loaded (Event 3032/3035)"
id: 425c2150-f7cf-45dd-aa4c-e79620fb7873
status: test
description: This rule identifies Windows Code Integrity operational events where a revoked signed image is loaded into the system. Such behavior matters because loading revoked binaries may allow an attacker to run code that is intended to be blocked, including scenarios where loading is permitted due to an attached kernel mode debugger. The detection relies on Code Integrity operational telemetry reporting EventID 3032 and 3035.
references:
- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations
- Internal Research
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/code_integrity/win_codeintegrity_revoked_image_loaded.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-06
tags:
- attack.privilege-escalation
logsource:
product: windows
service: codeintegrity-operational
detection:
selection:
EventID:
- 3032
- 3035
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 881b7725-47cc-4055-8000-425823344c59
type: derived