Sunturai
Back to results
LowSigmaHQFlorian Roth (Nextron Systems) +1

CodeIntegrity - Unmet Signing Level Requirements By File Under Validation

Detects attempted file load events that did not meet the signing level requirements. It often means the file's signature is revoked or a signature with the Lifetime Signing EKU has expired. This event is best…

Description

Detects attempted file load events that did not meet the signing level requirements. It often means the file's signature is revoked or a signature with the Lifetime Signing EKU has expired. This event is best correlated with EID 3089 to determine the error of the validation.

Detection logic

Detection requirements

Log source product
windows
Log source service
codeintegrity_operational

Known benign triggers

  • Antivirus and other third party products are known to trigger this rule quite a lot. Initial filters and tuning is required before using this rule.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice