Windows Code Integrity Operational: Unsigned Image Loaded
Alerts on Windows Code Integrity detecting that an unsigned image was loaded (Event ID 3037).
FreeReviewedSigma · High · v2
- Product
- windows
- Service
- codeintegrity-operational
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-06-06
- Updated
- 2026-07-31
What it detects
This rule flags Windows Code Integrity operational events indicating that an unsigned image was loaded into the system. Loading unsigned binaries can be used to bypass trust controls and may precede malicious execution, depending on the image and context. It relies on the presence of Code Integrity Operational telemetry (EventID 3037) reporting that an unsigned image was loaded.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations
- Internal ResearchInternal Research
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/code_integrity/win_codeintegrity_unsigned_image_loaded.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-code-integrity-unsigned-image-loaded-event-id-3037-c92c24e7
title: "Windows Code Integrity Operational: Unsigned Image Loaded"
id: 3827c048-eeac-4ea0-a6e0-5121d7f1a2ab
status: test
description: This rule flags Windows Code Integrity operational events indicating that an unsigned image was loaded into the system. Loading unsigned binaries can be used to bypass trust controls and may precede malicious execution, depending on the image and context. It relies on the presence of Code Integrity Operational telemetry (EventID 3037) reporting that an unsigned image was loaded.
references:
- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations
- Internal Research
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/code_integrity/win_codeintegrity_unsigned_image_loaded.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-06
tags:
- attack.privilege-escalation
logsource:
product: windows
service: codeintegrity-operational
detection:
selection:
EventID: 3037
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: c92c24e7-f595-493f-9c98-53d5142f5c18
type: derived