CodeIntegrity - Blocked Image/Driver Load For Policy Violation

Title: CodeIntegrity - Blocked Image/Driver Load For Policy Violation
Status: test
Description:Detects blocked load events that did not meet the authenticode signing level requirements or violated the code integrity policy.
References:
  -https://twitter.com/wdormann/status/1590434950335320065
  -https://github.com/MicrosoftDocs/windows-itpro-docs/blob/40fe118976734578f83e5e839b9c63ae7a4af82d/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md#windows-codeintegrity-operational-log
  -https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-11-10
modified:2023-06-07
Tags:

• -'attack.persistence'
• -'attack.privilege-escalation'
• -'attack.t1543'

Logsource:

• product: windows
• service: codeintegrity-operational

Detection:
  selection:
    EventID: '3077'
  condition:selection
Falsepositives:
  -Unknown
Level: high