Windows Code Integrity Unsigned Image Loaded (Event ID 3037)

title: Windows Code Integrity Unsigned Image Loaded (Event ID 3037)
id: 3827c048-eeac-4ea0-a6e0-5121d7f1a2ab
status: test
description: This rule flags Windows Code Integrity events where the system determines an unsigned image was loaded. Loading unsigned binaries can indicate tampering, bypass attempts, or deployment of untrusted code, which is a key step in potential privilege escalation and persistence. It relies on Windows codeintegrity operational telemetry for Event ID 3037, including the message indicating an unsigned image was loaded and the referenced placeholder for the image identifier.
references:
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/code_integrity/win_codeintegrity_unsigned_image_loaded.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-06
tags:
  - attack.privilege-escalation
logsource:
  product: windows
  service: codeintegrity-operational
detection:
  selection:
    EventID: 3037
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: c92c24e7-f595-493f-9c98-53d5142f5c18
    type: derived