detection.wiki

Detection rules › Sigma

CodeIntegrity - Blocked Driver Load With Revoked Certificate

Status
test
Severity
high
Log source
product windows, service codeintegrity-operational
Author
Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects blocked load attempts of revoked drivers

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1543 Create or Modify System Process
Privilege EscalationT1543 Create or Modify System Process

Event coverage

ProviderEventTitle
CodeIntegrityEvent ID 3023The driver FileNameBuffer is blocked from loading as the driver has been revoked by Microsoft.

Rule body yaml

title: CodeIntegrity - Blocked Driver Load With Revoked Certificate
id: 9b72b82d-f1c5-4632-b589-187159bc6ec1
status: test
description: Detects blocked load attempts of revoked drivers
references:
    - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
    - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations
    - Internal Research
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-06-06
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1543
logsource:
    product: windows
    service: codeintegrity-operational
detection:
    selection:
        EventID: 3023 # The driver %2 is blocked from loading as the driver has been revoked by Microsoft.
    condition: selection
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    EventID: 3023