Detectionhightest

CodeIntegrity - Blocked Driver Load With Revoked Certificate

Detects blocked load attempts of revoked drivers

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Nasreddine Bencherchali (Nextron Systems)Created Tue Jun 069b72b82d-f1c5-4632-b589-187159bc6ec1windows

Log Source

Windowscodeintegrity-operational

ProductWindows← raw: windows

Servicecodeintegrity-operational← raw: codeintegrity-operational

Detection Logic

detection:
    selection:
        EventID: 3023 # The driver %2 is blocked from loading as the driver has been revoked by Microsoft.
    condition: selection

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

Resolving title…

Internal Research

MITRE ATT&CK

Tactics

TA0003 · Persistence TA0004 · Privilege Escalation

Techniques

T1543 · Create or Modify System Process

Rule Metadata

Rule ID

9b72b82d-f1c5-4632-b589-187159bc6ec1

Status

test

Level

high

Type

Detection

Created

Tue Jun 06

Author

Nasreddine Bencherchali (Nextron Systems)

Path

rules/windows/builtin/code_integrity/win_codeintegrity_revoked_driver_blocked.yml

Raw Tags

attack.persistenceattack.privilege-escalationattack.t1543

View on GitHub