Blocked Driver Load Due to Revoked Certificate
Detects attempts to load drivers that have been revoked by Microsoft, as indicated by EventID 3023 in the CodeIntegrity-Operational log. This event signifies that the Windows Code Integrity component has blocked a driver from loading due to its revoked certificate status, which is a critical security measure to prevent malicious or vulnerable drivers from executing on the system.
Sigma
