Detectionhightest

CodeIntegrity - Revoked Image Loaded

Detects image load events with revoked certificates by code integrity.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Nasreddine Bencherchali (Nextron Systems)Created Tue Jun 06881b7725-47cc-4055-8000-425823344c59windows

Log Source

Windowscodeintegrity-operational

ProductWindows← raw: windows

Servicecodeintegrity-operational← raw: codeintegrity-operational

Detection Logic

detection:
    selection:
        EventID:
            - 3032 # Code Integrity determined a revoked image %2 is loaded into the system. Check with the publisher to see if a new signed version of the image is available.
            - 3035 # Code Integrity determined a revoked image %2 is loaded into the system. The image is allowed to load because kernel mode debugger is attached.
    condition: selection

False Positives

Unlikely

False positives are unlikely for most environments. High confidence detection.

References

Resolving title…

Internal Research

MITRE ATT&CK

Tactics