Message

Code Integrity determined an unsigned kernel module %2 is loaded into the system. Check with the publisher to see if a signed version of the kernel module is available.

Fields

Sigma Rules

• CodeIntegrity - Unsigned Kernel Module Loaded
  Detects the presence of a loaded unsigned kernel module on the system.

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Message

Code Integrity is unable to verify the image integrity of the file %2 because the set of per-page image hashes could not be found on the system.

Fields

Message

Code Integrity is unable to verify the image integrity of the file %2 because the set of per-page image hashes could not be found on the system. The image is allowed to load because kernel mode debugger is attached.

Fields

Message

Windows is unable to verify the image integrity of the file %2 because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Fields

Example Event

system:
  provider: Microsoft-Windows-CodeIntegrity
  guid: 4EE76BD8-3CF4-44A0-A0AC-3937643E37A3
  event_source_name: ''
  event_id: 3004
  version: 1
  level: 2
  task: 1
  opcode: 104
  keywords: 9223372036854775808
  time_created: '2023-11-06T02:03:39.834684+00:00'
  event_record_id: 2826
  correlation:
    ActivityID: E4DB489E-1037-0002-799D-F2E43710DA01
  execution:
    process_id: 18308
    thread_id: 9372
  channel: Microsoft-Windows-CodeIntegrity/Operational
  computer: WinDev2310Eval
  security:
    user_id: S-1-5-18
event_data:
  FileNameLength: 87
  FileNameBuffer: \Device\HarddiskVolume4\Program Files\Avira\Endpoint Protection
    SDK\amsi\x64\avamsi.dll
  SecureRequired: '0x80000000'
  RequestedSigningLevel: 7
  ProcessNameLength: 81
  ProcessNameBuffer: \Device\HarddiskVolume4\Program Files\Avira\Endpoint Protection
    SDK\wsc_agent.exe
message: ''

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations
• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

Code Integrity is unable to verify the image integrity of the file %2 because a file hash could not be found on the system. The image is allowed to load because kernel mode debugger is attached.

Fields

Message

Code Integrity found a set of per-page image hashes for the file %2 in a catalog %4.

Fields

Message

Code Integrity found a set of per-page image hashes for the file %2 in the image embedded certificate.

Fields

Message

Code Integrity found a file hash for the file %2 in a catalog %4.

Fields

Message

Code Integrity found a file hash for the file %2 in the image embedded certificate.

Fields

Message

Code Integrity was unable to load the %2 catalog. Status %3.

Fields

Example Event

system:
  provider: Microsoft-Windows-CodeIntegrity
  guid: 4EE76BD8-3CF4-44A0-A0AC-3937643E37A3
  event_source_name: ''
  event_id: 3010
  version: 1
  level: 3
  task: 2
  opcode: 100
  keywords: 9223372036854775808
  time_created: '2022-04-07T17:06:57.824463+00:00'
  event_record_id: 22
  correlation:
    ActivityID: DD7B0B6A-4A9E-0001-407E-7BDD9E4AD801
  execution:
    process_id: 5260
    thread_id: 1912
  channel: Microsoft-Windows-CodeIntegrity/Operational
  computer: WIN-FPV0DSIC9O6
  security:
    user_id: S-1-5-18
event_data:
  FileNameLength: 99
  FileNameBuffer: Microsoft-Windows-ServerCore-SKU-Foundation-merged-Package~31bf3856ad364e35~amd64~~10.0.20348.1.cat
  Status: '0xc0000034'
message: ''

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

Code Integrity successfully loaded the %2 catalog.

Fields

Message

Code Integrity started loading the %2 catalog.

Fields

Message

Code Integrity started reloading catalogs.

Message

Code Integrity completed reloading catalogs. Status %1.

Fields

Message

Code Integrity started validating file hash of %2 file.

Fields

Message

Code Integrity completed validating file hash. Status %1.

Fields

Message

Code Integrity started validating page hashes of %2 file.

Fields

Message

Code Integrity completed validating page hashes. Status %1.

Fields

Message

Code Integrity started loading catalog cache from %2 file.

Fields

Message

Code Integrity completed loading catalog cache. Status %1.

Fields

Message

Code Integrity determined a revoked kernel module %2 is loaded into the system.  Check with the publisher to see if a new signed version of the kernel module is available.

Fields

Sigma Rules

• CodeIntegrity - Revoked Kernel Driver Loaded
  Detects the load of a revoked kernel driver

Message

Code Integrity determined a revoked kernel module %2 is loaded into the system. The image is allowed to load because kernel mode debugger is attached.

Fields

Sigma Rules

• CodeIntegrity - Revoked Kernel Driver Loaded
  Detects the load of a revoked kernel driver

Message

The driver %2 is blocked from loading as the driver has been revoked by Microsoft.

Fields

Sigma Rules

• CodeIntegrity - Blocked Driver Load With Revoked Certificate
  Detects blocked load attempts of revoked drivers

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Message

Windows was unable to update the boot catalog cache file.  Status %1.

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Message

Code Integrity determined kernel module %2 is loaded into the system which does not have a valid embedded digital signature. Check with the publisher to see if an embedded signed version of the kernel module is available.

Fields

Message

Code Integrity was unable to load the %2 catalog because the signing certificate for this catalog has been revoked.  This can result in images failing to load because a valid signature cannot be found.  Check with the publisher to see if a new signed version of the catalog and images are available.

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Message

Code Integrity started loading catalog %2 from the cache file.

Fields

Message

Code Integrity started saving catalog cache to %2 file.

Fields

Message

Code Integrity completed saving catalog cache. Status %1.

Fields

Message

Code Integrity saved catalog %2 to the cache file.

Fields

Message

Code Integrity determined a revoked image %2 is loaded into the system.  Check with the publisher to see if a new signed version of the image is available.

Fields

Sigma Rules

• CodeIntegrity - Revoked Image Loaded
  Detects image load events with revoked certificates by code integrity.

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Message

Code Integrity determined that a process (%4) attempted to load %2 that did not meet the %5 signing level requirements.

Fields

Example Event

system:
  provider: Microsoft-Windows-CodeIntegrity
  guid: 4EE76BD8-3CF4-44A0-A0AC-3937643E37A3
  event_source_name: ''
  event_id: 3033
  version: 0
  level: 2
  task: 1
  opcode: 111
  keywords: 9223372036854775808
  time_created: '2023-11-06T01:54:48.422937+00:00'
  event_record_id: 2821
  correlation:
    ActivityID: E4DB489E-1037-0000-694C-EEE43710DA01
  execution:
    process_id: 16400
    thread_id: 16044
  channel: Microsoft-Windows-CodeIntegrity/Operational
  computer: WinDev2310Eval
  security:
    user_id: S-1-5-18
event_data:
  FileNameLength: 70
  FileNameBuffer: \Device\HarddiskVolume4\Program Files\Avast Software\Avast\aswAMSI.dll
  ProcessNameLength: 52
  ProcessNameBuffer: \Device\HarddiskVolume4\Windows\System32\svchost.exe
  RequestedPolicy: 12
  ValidatedPolicy: 1
  Status: 3221226536
message: ''

Sigma Rules

• CodeIntegrity - Unmet Signing Level Requirements By File Under Validation
  Detects attempted file load events that did not meet the signing level requirements. It often means the file's signature is revoked or a signature with the Lifetime Signing EKU has expired. This event is best correlated with EID 3089 to determine the error of the validation.

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations
• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

Code Integrity determined that a process (%4) attempted to load %2 that did not meet the %5 signing level requirements or violated code integrity policy. However, due to code integrity auditing policy, the image was allowed to load.

Fields

Sigma Rules

• CodeIntegrity - Unmet Signing Level Requirements By File Under Validation
  Detects attempted file load events that did not meet the signing level requirements. It often means the file's signature is revoked or a signature with the Lifetime Signing EKU has expired. This event is best correlated with EID 3089 to determine the error of the validation.

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Message

Code Integrity determined a revoked image %2 is loaded into the system. The image is allowed to load because kernel mode debugger is attached.

Fields

Sigma Rules

• CodeIntegrity - Revoked Image Loaded
  Detects image load events with revoked certificates by code integrity.

Message

Windows is unable to verify the integrity of the file %2 because the signing certificate has been revoked.  Check with the publisher to see if a new signed version of the kernel module is available.

Fields

Sigma Rules

• CodeIntegrity - Blocked Image Load With Revoked Certificate
  Detects blocked image load events with revoked certificates by code integrity.

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Message

Code Integrity determined an unsigned image %2 is loaded into the system. Check with the publisher to see if a signed version of the image is available.

Fields

Sigma Rules

• CodeIntegrity - Unsigned Image Loaded
  Detects loaded unsigned image on the system

Message

Code Integrity started validating image header of %2 file.

Fields

Message

Code Integrity completed validating image header. Status %1.

Fields

Message

Code Integrity started retrieving the cached data of %2 file.

Fields

Message

Code Integrity completed retrieval of file cache. Status %1.

Fields

Message

Code Integrity started setting the cache of %2 file.

Fields

Message

Code Integrity completed setting the file cache. Status %1.

Fields

Message

Code Integrity completed retrieval of file cache. Status %1.

Fields

Message

Code Integrity completed retrieval of file cache. Status %1.

Fields

Message

Code Integrity completed retrieval of file cache. Status %1.

Fields

Message

Code Integrity started setting the cache of %2 file.

Fields

Message

Code Integrity completed setting the file cache. Status %1.

Fields

Message

Code Integrity completed retrieval of file cache. Status %1.

Fields

Message

Code Integrity completed retrieval of file cache. Status %1.

Fields

Message

Code Integrity found a set of per-page image hashes for the file %2 in a catalog %4.

Fields

Message

Code Integrity found a set of per-page image hashes for the file %2 in a catalog %4.

Fields

Message

Code Integrity found a file hash for the file %2 in a catalog %4.

Fields

Message

Code Integrity found a file hash for the file %2 in a catalog %4.

Fields

Message

Code Integrity determined that a process (%4) attempted to load %2 that did not meet the security requirements for %5.

Fields

Message

Code Integrity determined that a process (%4) attempted to load %2 that did not meet the security requirements for %5. However, due to system policy, the image was allowed to load.

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Message

Code Integrity determined that a process (%4) attempted to load %2 that did not meet the security requirements for %5. However, due to system policy, the image was allowed to load.

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Message

Code Integrity determined that a process (%4) attempted to load %2 that did not meet the %5 signing level requirements or violated code integrity policy. However, due to code integrity auditing policy, the image was allowed to load.

Fields

Message

Code Integrity determined that a process (%4) attempted to load %2 that did not meet the %5 signing level requirements or violated code integrity policy. However, due to code integrity auditing policy, the image was allowed to load.

Fields

Message

Code Integrity determined that a process (%4) attempted to load %2 that did not meet the %5 signing level requirements or violated code integrity policy.

Fields

Message

Code Integrity was unable to load the weak crypto policy value from registry. Status %1.

Fields

Message

Code Integrity was unable to load the weak crypto policy from registry store. Status %1.

Fields

Message

Code Integrity was unable to load the weak crypto policies. Status %1.

Fields

Message

Code Integrity determined that the module %2 is not compatible with hypervisor enforcement due to it having non-page aligned sections.

Fields

Message

Code Integrity determined that the module %2 is not compatible with strict mode hypervisor enforcement due to it having an executable section that is also writable.

Fields

Message

Code Integrity was unable to verify a page for a module verified using hypervisor enforcement. Status %1.

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Message

Code Integrity determined that process (%4) spent %7 and %8 microseconds for Code Integrity check and policy check to load %2 with validated %6 signing level. For all components without EA cache, Code Integrity spent about %9? more time when policy enforced.

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Message

Code Integrity determined that a process (%4) attempted to load %2 that did not meet the %5 signing level requirements or violated code integrity policy. However, due to code integrity auditing policy, the image was allowed to load.

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Message

Code Integrity determined that a process (%4) attempted to load %2 that did not meet the %5 signing level requirements or violated code integrity policy.

Fields

Sigma Rules

• CodeIntegrity - Blocked Image/Driver Load For Policy Violation
  Detects blocked load events that did not meet the authenticode signing level requirements or violated the code integrity policy.

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Message

Code Integrity determined that a process (%4) attempted to load %2 that did not meet the %5 signing level requirements or violated code integrity policy. However, due to code integrity auditing policy, the image was allowed to load.

Fields

Message

Code Integrity determined that a process (%4) attempted to load %2 that did not meet the %5 signing level requirements or violated code integrity policy.

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Message

Code Integrity determined that a process (%4) attempted to load %2 that did not meet the %5 signing level requirements or violated code integrity policy. However, due to code integrity auditing policy, the image was allowed to load.

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Message

Code Integrity determined that a process (%4) attempted to load %2 that did not meet the %5 signing level requirements or violated code integrity policy.

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Message

Code Integrity determined kernel module %2 that did not meet the WHQL requirements is loaded into the system. However, due to code integrity auditing policy, the image was allowed to load.

Fields

Sigma Rules

• CodeIntegrity - Unmet WHQL Requirements For Loaded Kernel Module
  Detects loaded kernel modules that did not meet the WHQL signing requirements.

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Message

Code Integrity determined kernel module %2 that did not meet the WHQL requirements is loaded into the system. Check with the publisher to see if a WHQL compliant kernel module is available.

Fields

Sigma Rules

• CodeIntegrity - Unmet WHQL Requirements For Loaded Kernel Module
  Detects loaded kernel modules that did not meet the WHQL signing requirements.

Message

Code Integrity will enable WHQL driver enforcement for this boot session.  Settings %1. Exemption %2.

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Message

Code Integrity will disable WHQL driver enforcement for this boot session.  Settings %1.

Fields

Example Event

system:
  provider: Microsoft-Windows-CodeIntegrity
  guid: 4EE76BD8-3CF4-44A0-A0AC-3937643E37A3
  event_source_name: ''
  event_id: 3085
  version: 0
  level: 4
  task: 20
  opcode: 127
  keywords: 9223372036854775808
  time_created: '2022-04-07T16:52:38.896596+00:00'
  event_record_id: 31
  correlation:
    ActivityID: E0AAB88C-4A9F-0000-8DB8-AAE09F4AD801
  execution:
    process_id: 4
    thread_id: 8
  channel: Microsoft-Windows-CodeIntegrity/Operational
  computer: WIN-FPV0DSIC9O6.sigma.fr
  security:
    user_id: S-1-5-18
event_data:
  Settings: '0x0'
  Exemption: 1
message: ''

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations
• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

Code Integrity determined that a process (%4) attempted to load %2 that did not meet the signing requirements for Isolated User Mode.

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Message

Code Integrity determined that the kernel module %2 is not compatible with hypervisor enforcement. Status %3.

Fields

Message

Code Integrity testing module %2 against policy %11. Status %3

Fields

Message

Signature information for another event. Match using the Correlation Id.

Fields

Example Event

system:
  provider: Microsoft-Windows-CodeIntegrity
  guid: 4EE76BD8-3CF4-44A0-A0AC-3937643E37A3
  event_source_name: ''
  event_id: 3089
  version: 2
  level: 4
  task: 1
  opcode: 130
  keywords: 9223372036854775808
  time_created: '2023-11-06T02:03:39.834696+00:00'
  event_record_id: 2828
  correlation:
    ActivityID: E4DB489E-1037-0002-799D-F2E43710DA01
  execution:
    process_id: 18308
    thread_id: 9372
  channel: Microsoft-Windows-CodeIntegrity/Operational
  computer: WinDev2310Eval
  security:
    user_id: S-1-5-18
event_data:
  TotalSignatureCount: 2
  Signature: 1
  CacheState: 0
  Hash Size: 32
  Hash: CDFCFB06A61D9DEFD635A74F71DFB6BD5B3531EE7BAD61D942E259156C5F9746
  PageHash: false
  SignatureType: 1
  ValidatedSigningLevel: 8
  VerificationError: 18
  Flags: 0
  PolicyBits: 2050
  NotValidBefore: '2023-04-06T19:16:30.000000Z'
  NotValidAfter: '2024-04-03T19:16:30.000000Z'
  PublisherNameLength: 50
  PublisherName: Microsoft Windows Hardware Compatibility Publisher
  IssuerNameLength: 47
  IssuerName: Microsoft Windows Third Party Component CA 2014
  PublisherTBSHashSize: 32
  PublisherTBSHash: 0F06228DE7BACFBF65D426DF80C4E40C5ABFE5A2A402E6221DEA03B18897DE2B
  IssuerTBSHashSize: 32
  IssuerTBSHash: D8BE9E4D9074088EF818BC6F6FB64955E90378B2754155126FEEBBBD969CF0AE
message: ''

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations
• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

Code Integrity testing module %2 against policy %11. Status %3

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Message

Code Integrity testing module %2 against policy %11. Status %3

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Message

Code Integrity testing module %2 against policy %11. Status %3

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Message

Code Integrity testing module %2 against policy %11. Status %3

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Message

Code Integrity testing module %2 against policy %11. Status %3

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Message

other (see event data)

Message

other (see event data)

Message

Code Integrity policy %5 %2 is set to unrefreshable. id %4. Status: %6

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Message

No change in active Code Integrity policy %5 %2 after refresh. id %4. Status %6

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Message

Not allowed to refresh Code Integrity policy %5 %2. id %4. Status %6

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Message

other (see event data)

Message

Refreshed and activated Code Integrity policy %5 %2. id %4. Status %6

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Message

Refreshed but not activated Code Integrity policy %5 %2. id %4. Status %6

Fields

Message

Code Integrity policy refresh started for %1 policies.

Fields

Message

Code Integrity policy refresh finished for %1 policies.

Fields

Message

Ignoring refresh for Code Integrity policy ID %1. Status %2.

Fields

Message

Windows blocked file %2 which has been disallowed for protected processes.

Fields

Sigma Rules

• CodeIntegrity - Disallowed File For Protected Processes Has Been Blocked
  Detects block events for files that are disallowed by code integrity for protected processes

Message

Trying to refresh Code Integrity policy with policy ID %1.

Fields

Message

Code Integrity failed to set cache for %2 file due to validation failure. Status %3.

Fields

Message

Code Integrity failed to set cache for %2 file because it does not meet signing level requirements. Status %3.

Fields

Message

Code Integrity successfully switched from %3 mode to %4 mode.

Fields

Message

Code Integrity already switched from %3 mode to %4 mode.

Fields

Message

Code Integrity failed to switch from %3 mode to %4 mode with error code %5.

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Message

Code Integrity determined that a process (%6) attempted to load %2 that is not compatible with hypervisor enforcement. Failure bitmap %4. Status %3.

Fields

Message

Code Integrity determined that a process (%4) attempted to load %2 that did not meet the %5 signing level requirements or violated code integrity policy. However, due to code integrity auditing policy, the image was allowed to load.

Fields

Message

Code Integrity could not update the driver.stl revocation list. Status %1.

Fields

Message

Code Integrity determined that %4 is trying to load %2 which failed the dynamic code trust verification with error code of %5.

Fields

Message

Code Integrity determined that %4 is trying to load %2 which failed the dynamic code trust verification with error code of %5. However, due to code integrity auditing policy, the image was allowed to load.

Fields

Message

Signature information for Code Integrity policy ID %1.

Fields

Message

Code Integrity determined that a process (%4) attempted to load %2 that violated code integrity policy (Policy ID:%31). However, that decision was overriden by an endpoint security policy (Policy ID:%38).

Fields

Message

Smart App Control Block Deteails

Fields