Revoked Image Loaded by Code Integrity
Detects when Code Integrity identifies and blocks the loading of an image (DLL, EXE, etc.) that has a revoked digital certificate. This indicates an attempt to load untrusted or malicious code, potentially bypassing security controls. Event ID 3035 specifically notes cases where the image is allowed to load due to a kernel mode debugger being attached, which is a highly suspicious activity.
Sigma
