Description

Code Integrity determined an unsigned kernel module FileNameBuffer is loaded into the system. Check with the publisher to see if a signed version of the kernel module is available.

Message #

Code Integrity determined an unsigned kernel module %2 is loaded into the system. Check with the publisher to see if a signed version of the kernel module is available.

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Description

Code Integrity is unable to verify the image integrity of the file FileNameBuffer because the set of per-page image hashes could not be found on the system.

Message #

Code Integrity is unable to verify the image integrity of the file %2 because the set of per-page image hashes could not be found on the system.

Fields #

Message #

Code Integrity is unable to verify the image integrity of the file %2 because the set of per-page image hashes could not be found on the system. The image is allowed to load because kernel mode debugger is attached.

Fields #

Message #

Windows is unable to verify the image integrity of the file %2 because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CodeIntegrity",
    "guid": "4EE76BD8-3CF4-44A0-A0AC-3937643E37A3",
    "event_source_name": "",
    "event_id": 3004,
    "version": 1,
    "level": 2,
    "task": 1,
    "opcode": 104,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T02:03:39.834684+00:00",
    "event_record_id": 2826,
    "correlation": {
      "ActivityID": "E4DB489E-1037-0002-799D-F2E43710DA01"
    },
    "execution": {
      "process_id": 18308,
      "thread_id": 9372
    },
    "channel": "Microsoft-Windows-CodeIntegrity/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "FileNameLength": 87,
    "FileNameBuffer": "\\Device\\HarddiskVolume4\\Program Files\\Avira\\Endpoint Protection SDK\\amsi\\x64\\avamsi.dll",
    "SecureRequired": "0x80000000",
    "RequestedSigningLevel": 7,
    "ProcessNameLength": 81,
    "ProcessNameBuffer": "\\Device\\HarddiskVolume4\\Program Files\\Avira\\Endpoint Protection SDK\\wsc_agent.exe"
  },
  "message": ""
}

References #

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations
• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Description

Code Integrity is unable to verify the image integrity of the file FileNameBuffer because a file hash could not be found on the system. The image is allowed to load because kernel mode debugger is attached.

Message #

Code Integrity is unable to verify the image integrity of the file %2 because a file hash could not be found on the system. The image is allowed to load because kernel mode debugger is attached.

Fields #

Description

Code Integrity found a set of per-page image hashes for the file FileNameBuffer in a catalog CatalogNameBuffer.

Message #

Code Integrity found a set of per-page image hashes for the file %2 in a catalog %4.

Fields #

Description

Code Integrity found a set of per-page image hashes for the file FileNameBuffer in the image embedded certificate.

Message #

Code Integrity found a set of per-page image hashes for the file %2 in the image embedded certificate.

Fields #

Description

Code Integrity found a file hash for the file FileNameBuffer in a catalog CatalogNameBuffer.

Message #

Code Integrity found a file hash for the file %2 in a catalog %4.

Fields #

Description

Code Integrity found a file hash for the file FileNameBuffer in the image embedded certificate.

Message #

Code Integrity found a file hash for the file %2 in the image embedded certificate.

Fields #

Description

Code Integrity was unable to load the FileNameBuffer catalog. Status Status.

Message #

Code Integrity was unable to load the %2 catalog. Status %3.

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CodeIntegrity",
    "guid": "4EE76BD8-3CF4-44A0-A0AC-3937643E37A3",
    "event_source_name": "",
    "event_id": 3010,
    "version": 1,
    "level": 3,
    "task": 2,
    "opcode": 100,
    "keywords": 9223372036854775808,
    "time_created": "2022-04-07T17:06:57.824463+00:00",
    "event_record_id": 22,
    "correlation": {
      "ActivityID": "DD7B0B6A-4A9E-0001-407E-7BDD9E4AD801"
    },
    "execution": {
      "process_id": 5260,
      "thread_id": 1912
    },
    "channel": "Microsoft-Windows-CodeIntegrity/Operational",
    "computer": "WIN-FPV0DSIC9O6",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "FileNameLength": 99,
    "FileNameBuffer": "Microsoft-Windows-ServerCore-SKU-Foundation-merged-Package~31bf3856ad364e35~amd64~~10.0.20348.1.cat",
    "Status": "0xc0000034"
  },
  "message": ""
}

References #

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Description

Code Integrity successfully loaded the FileNameBuffer catalog.

Message #

Code Integrity successfully loaded the %2 catalog.

Fields #

Description

Code Integrity started loading the FileNameBuffer catalog.

Message #

Code Integrity started loading the %2 catalog.

Fields #

Description

Code Integrity started reloading catalogs.

Message #

Code Integrity started reloading catalogs.

Description

Code Integrity completed reloading catalogs. Status Status.

Message #

Code Integrity completed reloading catalogs. Status %1.

Fields #

Description

Code Integrity started validating file hash of FileNameBuffer file.

Message #

Code Integrity started validating file hash of %2 file.

Fields #

Description

Code Integrity completed validating file hash. Status Status.

Message #

Code Integrity completed validating file hash. Status %1.

Fields #

Description

Code Integrity started validating page hashes of FileNameBuffer file.

Message #

Code Integrity started validating page hashes of %2 file.

Fields #

Description

Code Integrity completed validating page hashes. Status Status.

Message #

Code Integrity completed validating page hashes. Status %1.

Fields #

Description

Code Integrity started loading catalog cache from FileNameBuffer file.

Message #

Code Integrity started loading catalog cache from %2 file.

Fields #

Description

Code Integrity completed loading catalog cache. Status Status.

Message #

Code Integrity completed loading catalog cache. Status %1.

Fields #

Description

Code Integrity determined a revoked kernel module FileNameBuffer is loaded into the system. Check with the publisher to see if a new signed version of the kernel module is available.

Message #

Code Integrity determined a revoked kernel module %2 is loaded into the system.  Check with the publisher to see if a new signed version of the kernel module is available.

Fields #

Related Events #

Description

Code Integrity determined a revoked kernel module FileNameBuffer is loaded into the system. The image is allowed to load because kernel mode debugger is attached.

Message #

Code Integrity determined a revoked kernel module %2 is loaded into the system. The image is allowed to load because kernel mode debugger is attached.

Fields #

Related Events #

Description

The driver FileNameBuffer is blocked from loading as the driver has been revoked by Microsoft.

Message #

The driver %2 is blocked from loading as the driver has been revoked by Microsoft.

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Description

Windows was unable to update the boot catalog cache file. Status Status.

Message #

Windows was unable to update the boot catalog cache file.  Status %1.

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Message #

Code Integrity determined kernel module %2 is loaded into the system which does not have a valid embedded digital signature. Check with the publisher to see if an embedded signed version of the kernel module is available.

Fields #

Message #

Code Integrity was unable to load the %2 catalog because the signing certificate for this catalog has been revoked.  This can result in images failing to load because a valid signature cannot be found.  Check with the publisher to see if a new signed version of the catalog and images are available.

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Description

Code Integrity started loading catalog FileNameBuffer from the cache file.

Message #

Code Integrity started loading catalog %2 from the cache file.

Fields #

Description

Code Integrity started saving catalog cache to FileNameBuffer file.

Message #

Code Integrity started saving catalog cache to %2 file.

Fields #

Description

Code Integrity completed saving catalog cache. Status Status.

Message #

Code Integrity completed saving catalog cache. Status %1.

Fields #

Description

Code Integrity saved catalog FileNameBuffer to the cache file.

Message #

Code Integrity saved catalog %2 to the cache file.

Fields #

Description

Code Integrity determined a revoked image FileNameBuffer is loaded into the system. Check with the publisher to see if a new signed version of the image is available.

Message #

Code Integrity determined a revoked image %2 is loaded into the system.  Check with the publisher to see if a new signed version of the image is available.

Fields #

Related Events #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Description

Code Integrity determined that a process (ProcessNameBuffer) attempted to load FileNameBuffer that did not meet the RequestedPolicy signing level requirements.

Message #

Code Integrity determined that a process (%4) attempted to load %2 that did not meet the %5 signing level requirements.

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CodeIntegrity",
    "guid": "4EE76BD8-3CF4-44A0-A0AC-3937643E37A3",
    "event_source_name": "",
    "event_id": 3033,
    "version": 0,
    "level": 2,
    "task": 1,
    "opcode": 111,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T01:54:48.422937+00:00",
    "event_record_id": 2821,
    "correlation": {
      "ActivityID": "E4DB489E-1037-0000-694C-EEE43710DA01"
    },
    "execution": {
      "process_id": 16400,
      "thread_id": 16044
    },
    "channel": "Microsoft-Windows-CodeIntegrity/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "FileNameLength": 70,
    "FileNameBuffer": "\\Device\\HarddiskVolume4\\Program Files\\Avast Software\\Avast\\aswAMSI.dll",
    "ProcessNameLength": 52,
    "ProcessNameBuffer": "\\Device\\HarddiskVolume4\\Windows\\System32\\svchost.exe",
    "RequestedPolicy": 12,
    "ValidatedPolicy": 1,
    "Status": 3221226536
  },
  "message": ""
}

Related Events #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations
• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message #

Code Integrity determined that a process (%4) attempted to load %2 that did not meet the %5 signing level requirements or violated code integrity policy. However, due to code integrity auditing policy, the image was allowed to load.

Fields #

Related Events #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Description

Code Integrity determined a revoked image FileNameBuffer is loaded into the system. The image is allowed to load because kernel mode debugger is attached.

Message #

Code Integrity determined a revoked image %2 is loaded into the system. The image is allowed to load because kernel mode debugger is attached.

Fields #

Related Events #

Description

Windows is unable to verify the integrity of the file FileNameBuffer because the signing certificate has been revoked. Check with the publisher to see if a new signed version of the kernel module is available.

Message #

Windows is unable to verify the integrity of the file %2 because the signing certificate has been revoked.  Check with the publisher to see if a new signed version of the kernel module is available.

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Description

Code Integrity determined an unsigned image FileNameBuffer is loaded into the system. Check with the publisher to see if a signed version of the image is available.

Message #

Code Integrity determined an unsigned image %2 is loaded into the system. Check with the publisher to see if a signed version of the image is available.

Fields #

Description

Code Integrity started validating image header of FileNameBuffer file.

Message #

Code Integrity started validating image header of %2 file.

Fields #

Description

Code Integrity completed validating image header. Status Status.

Message #

Code Integrity completed validating image header. Status %1.

Fields #

Description

Code Integrity started retrieving the cached data of FileNameBuffer file.

Message #

Code Integrity started retrieving the cached data of %2 file.

Fields #

Description

Code Integrity completed retrieval of file cache. Status Status.

Message #

Code Integrity completed retrieval of file cache. Status %1.

Fields #

Description

Code Integrity started setting the cache of FileNameBuffer file.

Message #

Code Integrity started setting the cache of %2 file.

Fields #

Description

Code Integrity completed setting the file cache. Status Status.

Message #

Code Integrity completed setting the file cache. Status %1.

Fields #

Description

Code Integrity completed retrieval of file cache. Status Status.

Message #

Code Integrity completed retrieval of file cache. Status %1.

Fields #

Description

Code Integrity completed retrieval of file cache. Status Status.

Message #

Code Integrity completed retrieval of file cache. Status %1.

Fields #

Description

Code Integrity completed retrieval of file cache. Status Status.

Message #

Code Integrity completed retrieval of file cache. Status %1.

Fields #

Description

Code Integrity started setting the cache of FileNameBuffer file.

Message #

Code Integrity started setting the cache of %2 file.

Fields #

Description

Code Integrity completed setting the file cache. Status Status.

Message #

Code Integrity completed setting the file cache. Status %1.

Fields #

Description

Code Integrity completed retrieval of file cache. Status Status.

Message #

Code Integrity completed retrieval of file cache. Status %1.

Fields #

Description

Code Integrity completed retrieval of file cache. Status Status.

Message #

Code Integrity completed retrieval of file cache. Status %1.

Fields #

Description

Code Integrity found a set of per-page image hashes for the file FileNameBuffer in a catalog CatalogNameBuffer.

Message #

Code Integrity found a set of per-page image hashes for the file %2 in a catalog %4.

Fields #

Description

Code Integrity found a set of per-page image hashes for the file FileNameBuffer in a catalog CatalogNameBuffer.

Message #

Code Integrity found a set of per-page image hashes for the file %2 in a catalog %4.

Fields #

Description

Code Integrity found a file hash for the file FileNameBuffer in a catalog CatalogNameBuffer.

Message #

Code Integrity found a file hash for the file %2 in a catalog %4.

Fields #

Description

Code Integrity found a file hash for the file FileNameBuffer in a catalog CatalogNameBuffer.

Message #

Code Integrity found a file hash for the file %2 in a catalog %4.

Fields #

Description

Code Integrity determined that a process (ProcessNameBuffer) attempted to load FileNameBuffer that did not meet the security requirements for RequirementType.

Message #

Code Integrity determined that a process (%4) attempted to load %2 that did not meet the security requirements for %5.

Fields #

Description

Code Integrity determined that a process (ProcessNameBuffer) attempted to load FileNameBuffer that did not meet the security requirements for RequirementType. However, due to system policy, the image was allowed to load.

Message #

Code Integrity determined that a process (%4) attempted to load %2 that did not meet the security requirements for %5. However, due to system policy, the image was allowed to load.

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Description

Code Integrity determined that a process (ProcessNameBuffer) attempted to load FileNameBuffer that did not meet the security requirements for RequirementType. However, due to system policy, the image was allowed to load.

Message #

Code Integrity determined that a process (%4) attempted to load %2 that did not meet the security requirements for %5. However, due to system policy, the image was allowed to load.

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Message #

Code Integrity determined that a process (%4) attempted to load %2 that did not meet the %5 signing level requirements or violated code integrity policy. However, due to code integrity auditing policy, the image was allowed to load.

Fields #

Message #

Code Integrity determined that a process (%4) attempted to load %2 that did not meet the %5 signing level requirements or violated code integrity policy. However, due to code integrity auditing policy, the image was allowed to load.

Fields #

Description

Code Integrity determined that a process (ProcessNameBuffer) attempted to load FileNameBuffer that did not meet the RequestedPolicy signing level requirements or violated code integrity policy.

Message #

Code Integrity determined that a process (%4) attempted to load %2 that did not meet the %5 signing level requirements or violated code integrity policy.

Fields #

Description

Code Integrity was unable to load the weak crypto policy value from registry. Status Status.

Message #

Code Integrity was unable to load the weak crypto policy value from registry. Status %1.

Fields #

Description

Code Integrity was unable to load the weak crypto policy from registry store. Status Status.

Message #

Code Integrity was unable to load the weak crypto policy from registry store. Status %1.

Fields #

Description

Code Integrity was unable to load the weak crypto policies. Status Status.

Message #

Code Integrity was unable to load the weak crypto policies. Status %1.

Fields #

Description

Code Integrity determined that the module FileNameBuffer is not compatible with hypervisor enforcement due to it having non-page aligned sections.

Message #

Code Integrity determined that the module %2 is not compatible with hypervisor enforcement due to it having non-page aligned sections.

Fields #

Description

Code Integrity determined that the module FileNameBuffer is not compatible with strict mode hypervisor enforcement due to it having an executable section that is also writable.

Message #

Code Integrity determined that the module %2 is not compatible with strict mode hypervisor enforcement due to it having an executable section that is also writable.

Fields #

Description

Code Integrity was unable to verify a page for a module verified using hypervisor enforcement. Status Status.

Message #

Code Integrity was unable to verify a page for a module verified using hypervisor enforcement. Status %1.

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Message #

Code Integrity determined that process (%4) spent %7 and %8 microseconds for Code Integrity check and policy check to load %2 with validated %6 signing level. For all components without EA cache, Code Integrity spent about %9? more time when policy enforced.

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Message #

Code Integrity determined that a process (%4) attempted to load %2 that did not meet the %5 signing level requirements or violated code integrity policy. However, due to code integrity auditing policy, the image was allowed to load.

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CodeIntegrity",
    "guid": "4EE76BD8-3CF4-44A0-A0AC-3937643E37A3",
    "event_source_name": "",
    "event_id": 3076,
    "version": 5,
    "level": 4,
    "task": 18,
    "opcode": 118,
    "keywords": 9223372036854775808,
    "time_created": "2025-12-31T19:36:05.795115+00:00",
    "event_record_id": 13,
    "correlation": {
      "ActivityID": "8D2E1BCA-7A8C-0000-9F81-2E8D8C7ADC01"
    },
    "execution": {
      "process_id": 6868,
      "thread_id": 7996
    },
    "channel": "Microsoft-Windows-CodeIntegrity/Operational",
    "computer": "WIN11-22H2-X64",
    "security": {
      "user_id": "S-1-5-21-3407486967-1585450050-1838039599-1000"
    }
  },
  "event_data": {
    "FileNameLength": 54,
    "File Name": "\\Device\\HarddiskVolume4\\Windows\\System32\\wbem\\WMIC.exe",
    "ProcessNameLength": 78,
    "Process Name": "\\Device\\HarddiskVolume4\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
    "Requested Signing Level": 2,
    "Validated Signing Level": 12,
    "Status": "0xc0e90002",
    "SHA1 Hash Size": 20,
    "SHA1 Hash": "9CBEBC5A163FC08C9F62AED561265C658C06FC83",
    "SHA256 Hash Size": 32,
    "SHA256 Hash": "C0BAFA03FEBE627230378761B35F734722137760B5BFD12706EE8D4100E1A142",
    "SHA1 Flat Hash Size": 20,
    "SHA1 Flat Hash": "CC3C648E9265A68A7E6032076E44413CDD1B10F9",
    "SHA256 Flat Hash Size": 32,
    "SHA256 Flat Hash": "993A2E38A27807096F75E83E348F15929391CA84B7DDA3D5651FB589787953C3",
    "USN": 0,
    "SI Signing Scenario": 1,
    "PolicyNameLength": 37,
    "PolicyName": "VerifiedAndReputableDesktopEvaluation",
    "PolicyIDLength": 17,
    "PolicyID": "22609.1000.220423",
    "PolicyHashSize": 32,
    "PolicyHash": "59FCF3FD0476A19E7D2A2A82DF3E49839A4D7C366C156CB636B8854E280E77D9",
    "OriginalFileNameLength": 8,
    "OriginalFileName": "wmic.exe",
    "InternalNameLength": 8,
    "InternalName": "wmic.exe",
    "FileDescriptionLength": 23,
    "FileDescription": "WMI Commandline Utility",
    "ProductNameLength": 36,
    "ProductName": "Microsoft® Windows® Operating System",
    "FileVersion": "10.0.22621.1",
    "PolicyGUID": "1283AC0F-FFF1-49AE-ADA1-8A933130CAD6",
    "UserWriteable": false,
    "PackageFamilyNameLength": 0,
    "PackageFamilyName": ""
  },
  "message": ""
}

References #

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Description

Code Integrity determined that a process (Process Name) attempted to load File Name that did not meet the Requested Signing Level signing level requirements or violated code integrity policy.

Message #

Code Integrity determined that a process (%4) attempted to load %2 that did not meet the %5 signing level requirements or violated code integrity policy.

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Message #

Code Integrity determined that a process (%4) attempted to load %2 that did not meet the %5 signing level requirements or violated code integrity policy. However, due to code integrity auditing policy, the image was allowed to load.

Fields #

Description

Code Integrity determined that a process (Process Name) attempted to load File Name that did not meet the Requested Signing Level signing level requirements or violated code integrity policy.

Message #

Code Integrity determined that a process (%4) attempted to load %2 that did not meet the %5 signing level requirements or violated code integrity policy.

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Message #

Code Integrity determined that a process (%4) attempted to load %2 that did not meet the %5 signing level requirements or violated code integrity policy. However, due to code integrity auditing policy, the image was allowed to load.

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Description

Code Integrity determined that a process (Process Name) attempted to load File Name that did not meet the Requested Signing Level signing level requirements or violated code integrity policy.

Message #

Code Integrity determined that a process (%4) attempted to load %2 that did not meet the %5 signing level requirements or violated code integrity policy.

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Description

Code Integrity determined kernel module FileNameBuffer that did not meet the WHQL requirements is loaded into the system. However, due to code integrity auditing policy, the image was allowed to load.

Message #

Code Integrity determined kernel module %2 that did not meet the WHQL requirements is loaded into the system. However, due to code integrity auditing policy, the image was allowed to load.

Fields #

Related Events #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Description

Code Integrity determined kernel module FileNameBuffer that did not meet the WHQL requirements is loaded into the system. Check with the publisher to see if a WHQL compliant kernel module is available.

Message #

Code Integrity determined kernel module %2 that did not meet the WHQL requirements is loaded into the system. Check with the publisher to see if a WHQL compliant kernel module is available.

Fields #

Related Events #

Description

Code Integrity will enable WHQL driver enforcement for this boot session. Settings Settings. Exemption Exemption.

Message #

Code Integrity will enable WHQL driver enforcement for this boot session.  Settings %1. Exemption %2.

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CodeIntegrity",
    "guid": "4EE76BD8-3CF4-44A0-A0AC-3937643E37A3",
    "event_source_name": "",
    "event_id": 3084,
    "version": 0,
    "level": 4,
    "task": 20,
    "opcode": 127,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-11T06:27:10.407182+00:00",
    "event_record_id": 875,
    "correlation": {
      "ActivityID": "164E10E5-B120-0000-E710-4E1620B1DC01"
    },
    "execution": {
      "process_id": 4,
      "thread_id": 8
    },
    "channel": "Microsoft-Windows-CodeIntegrity/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Settings": "0x0",
    "Exemption": 1
  },
  "message": ""
}

References #

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Description

Code Integrity will disable WHQL driver enforcement for this boot session. Settings Settings.

Message #

Code Integrity will disable WHQL driver enforcement for this boot session.  Settings %1.

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CodeIntegrity",
    "guid": "4EE76BD8-3CF4-44A0-A0AC-3937643E37A3",
    "event_source_name": "",
    "event_id": 3085,
    "version": 0,
    "level": 4,
    "task": 20,
    "opcode": 127,
    "keywords": 9223372036854775808,
    "time_created": "2022-04-07T16:52:38.896596+00:00",
    "event_record_id": 31,
    "correlation": {
      "ActivityID": "E0AAB88C-4A9F-0000-8DB8-AAE09F4AD801"
    },
    "execution": {
      "process_id": 4,
      "thread_id": 8
    },
    "channel": "Microsoft-Windows-CodeIntegrity/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Settings": "0x0",
    "Exemption": 1
  },
  "message": ""
}

References #

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations
• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Description

Code Integrity determined that a process (ProcessNameBuffer) attempted to load FileNameBuffer that did not meet the signing requirements for Isolated User Mode.

Message #

Code Integrity determined that a process (%4) attempted to load %2 that did not meet the signing requirements for Isolated User Mode.

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Description

Code Integrity determined that the kernel module FileNameBuffer is not compatible with hypervisor enforcement. Status Status.

Message #

Code Integrity determined that the kernel module %2 is not compatible with hypervisor enforcement. Status %3.

Fields #

Description

Code Integrity testing module FileName against policy PolicyName. Status StatusCode.

Message #

Code Integrity testing module %2 against policy %11. Status %3

Fields #

Description

Signature information for another event. Match using the Correlation Id.

Message #

Signature information for another event. Match using the Correlation Id.

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CodeIntegrity",
    "guid": "4EE76BD8-3CF4-44A0-A0AC-3937643E37A3",
    "event_source_name": "",
    "event_id": 3089,
    "version": 2,
    "level": 4,
    "task": 1,
    "opcode": 130,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T02:03:39.834696+00:00",
    "event_record_id": 2828,
    "correlation": {
      "ActivityID": "E4DB489E-1037-0002-799D-F2E43710DA01"
    },
    "execution": {
      "process_id": 18308,
      "thread_id": 9372
    },
    "channel": "Microsoft-Windows-CodeIntegrity/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "TotalSignatureCount": 2,
    "Signature": 1,
    "CacheState": 0,
    "Hash Size": 32,
    "Hash": "CDFCFB06A61D9DEFD635A74F71DFB6BD5B3531EE7BAD61D942E259156C5F9746",
    "PageHash": false,
    "SignatureType": 1,
    "ValidatedSigningLevel": 8,
    "VerificationError": 18,
    "Flags": 0,
    "PolicyBits": 2050,
    "NotValidBefore": "2023-04-06T19:16:30.000000Z",
    "NotValidAfter": "2024-04-03T19:16:30.000000Z",
    "PublisherNameLength": 50,
    "PublisherName": "Microsoft Windows Hardware Compatibility Publisher",
    "IssuerNameLength": 47,
    "IssuerName": "Microsoft Windows Third Party Component CA 2014",
    "PublisherTBSHashSize": 32,
    "PublisherTBSHash": "0F06228DE7BACFBF65D426DF80C4E40C5ABFE5A2A402E6221DEA03B18897DE2B",
    "IssuerTBSHashSize": 32,
    "IssuerTBSHash": "D8BE9E4D9074088EF818BC6F6FB64955E90378B2754155126FEEBBBD969CF0AE"
  },
  "message": ""
}