Windows Code Integrity Policy Violations
This brief covers the detection of blocked image or driver load events that fail to meet Windows Defender Application Control (WDAC) signing level requirements.
Triage facts
Revision 1- Applicability
- Windows
- Evidence
- Unknown
- Severity
- Medium
- Action
- Monitor or close
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 10, 03:35 UTC
- Detection
- 1 rule
- Source quality
- A2Roughly even chance
Windows Defender Application Control (WDAC) and Code Integrity mechanisms monitor for unauthorized code execution. Event ID 3077 is generated when the system blocks an image or kernel-mode driver from loading because it does not meet the enforced policy signing level requirements or explicitly violates a configured Code Integrity policy. This telemetry is indicative of either misconfigured legitimate software, local policy conflicts, or attempts by an attacker to load unsigned or malicious drivers to gain kernel-level persistence.
Recommendation
- Enable the "Microsoft-Windows-CodeIntegrity/Operational" event log channel across all Windows endpoints to capture Event ID 3077.
- Investigate occurrences of Event ID 3077 to determine if the blocked file is a legitimate business application that requires an updated policy or a malicious attempt to load an unauthorized driver.
- Deploy the Sigma rule provided below to SIEM platforms to centralize monitoring of policy violations.
Threat Hunt
Identify high-frequency Event ID 3077 occurrences per host to detect potential persistence attempts
Data: CodeIntegrity-Operational Event ID 3077
Mitigations
Review and audit existing WDAC policies to ensure valid business drivers are signed correctly
Code Integrity policy violations
Detection coverage 1
Detect Windows Code Integrity Policy Block (Event ID 3077)
mediumDetects blocked load events that did not meet the authenticode signing level requirements or violated the code integrity policy.
Detection queries are available on the platform. Get full rules →