Event ID 3032 — Code Integrity determined a revoked image FileNameBuffer is loaded into the system.
Description
Code Integrity determined a revoked image FileNameBuffer is loaded into the system. Check with the publisher to see if a new signed version of the image is available.
Message #
Fields #
| Name | Description |
|---|---|
FileNameLength UInt16 | — |
FileNameBuffer UnicodeString | — |
SecureRequired HexInt32 | — |
RequestedSigningLevel UInt8 | — |
ProcessNameLength UInt16 | — |
ProcessNameBuffer UnicodeString | — |
Detection Rules #
View all rules referencing this event →
Sigma # view in reference
- CodeIntegrity - Revoked Image Loaded source high: Detects image load events with revoked certificates by code integrity.↳ also matches:Event ID 3035: Code Integrity determined a revoked image FileNameBuffer is loaded into the system.