CodeIntegrity - Blocked Driver Load With Revoked Certificate

Title: CodeIntegrity - Blocked Driver Load With Revoked Certificate
Status: test
Description:Detects blocked load attempts of revoked drivers
References:
  -https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
  -https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations
  -Internal Research
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-06-06
modified:None
Tags:

• -'attack.persistence'
• -'attack.privilege-escalation'
• -'attack.t1543'

Logsource:

• product: windows
• service: codeintegrity-operational

Detection:
  selection:
    EventID: '3023'
  condition:selection
Falsepositives:
  -Unknown
Level: high