Code Integrity Blocked Image/Driver Load
Detects attempts to load images or drivers that violate Windows Code Integrity policies, indicating a potential bypass attempt or the execution of unsigned/malicious code. This event signifies that the system blocked the load due to unmet authenticode signing level requirements or a policy violation.
Sigma
