Possible CodeIntegrity - Unmet Signing Level Requirements By File Under Validation (via codeintegrity-operational)

title: Possible CodeIntegrity - Unmet Signing Level Requirements By File Under Validation (via codeintegrity-operational)
id: 9133331c-7944-56c1-ad05-78ec21047d86
status: stable
description: This rule detects attempted file load events that did not meet the signing level requirements. It frequently means the file's signature is revoked or a signature with the Lifetime Signing EKU has expired. This event is best correlated with EID 3089 to determine the error of the validation.
references:
    - https://twitter.com/SBousseaden/status/1483810148602814466
    - https://github.com/MicrosoftDocs/windows-itpro-docs/blob/40fe118976734578f83e5e839b9c63ae7a4af82d/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md#windows-codeintegrity-operational-log
    - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations
    - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
author: Huntrule Team
date: 2026-01-19
tags:
    - attack.execution
    - attack.defense-evasion
    - attack.t1553.002
logsource:
    product: windows
    service: codeintegrity-operational
detection:
    selection:
        EventID:
            - 3033
            - 3034
    filter_optional_dtrace:
        FileNameBuffer|endswith: '\Program Files\DTrace\dtrace.dll'
        ProcessNameBuffer|endswith: '\Windows\System32\svchost.exe'
        RequestedPolicy: 12
    filter_optional_av_generic:
        FileNameBuffer|contains: '\Windows\System32\DriverStore\FileRepository\'
        FileNameBuffer|endswith: '\igd10iumd64.dll'
        RequestedPolicy: 7
    filter_optional_electron_based_app:
        FileNameBuffer|endswith: '\Windows\System32\nvspcap64.dll'
        ProcessNameBuffer|endswith:
            - '\AppData\Local\Keybase\Gui\Keybase.exe'
            - '\Microsoft\Teams\stage\Teams.exe'
        RequestedPolicy: 8
    filter_optional_bonjour:
        FileNameBuffer|endswith: '\Program Files\Bonjour\mdnsNSP.dll'
        ProcessNameBuffer|endswith:
            - '\Windows\System32\svchost.exe'
            - '\Windows\System32\SIHClient.exe'
        RequestedPolicy:
            - 8
            - 12
    filter_optional_msoffice_1:
        FileNameBuffer|contains: '\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE'
        FileNameBuffer|endswith: '\MSOXMLMF.DLL'
        RequestedPolicy: 7
    filter_optional_msoffice_2:
        ProcessNameBuffer|contains: '\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office'
        FileNameBuffer|contains: '\Windows\System32\'
        RequestedPolicy: 8
    filter_optional_slack:
        FileNameBuffer|endswith: '\Windows\System32\nvspcap64.dll'
        ProcessNameBuffer|contains: '\AppData\Local\slack\app-'
        ProcessNameBuffer|endswith: '\slack.exe'
        RequestedPolicy: 8
    filter_optional_firefox:
        FileNameBuffer|endswith:
            - '\Mozilla Firefox\mozavcodec.dll'
            - '\Mozilla Firefox\mozavutil.dll'
        ProcessNameBuffer|endswith: '\Mozilla Firefox\firefox.exe'
        RequestedPolicy: 8
    filter_optional_avast:
        FileNameBuffer|endswith:
            - '\Program Files\Avast Software\Avast\aswAMSI.dll'
            - '\Program Files (x86)\Avast Software\Avast\aswAMSI.dll'
        RequestedPolicy:
            - 8
            - 12
    filter_main_gac:
        FileNameBuffer|contains: '\Windows\assembly\GAC\'
        ProcessNameBuffer|endswith: '\mscorsvw.exe'
        ProcessNameBuffer|contains: '\Windows\Microsoft.NET\'
        RequestedPolicy: 8
    filter_optional_google_drive:
        FileNameBuffer|contains: '\Program Files\Google\Drive File Stream\'
        FileNameBuffer|endswith: '\crashpad_handler.exe'
        ProcessNameBuffer|endswith: '\Windows\ImmersiveControlPanel\SystemSettings.exe'
        RequestedPolicy: 8
    filter_optional_trend_micro:
        FileNameBuffer|endswith: '\Trend Micro\Client Server Security Agent\perficrcperfmonmgr.dll'
        RequestedPolicy: 8
    filter_optional_mdns_responder:
        FileNameBuffer|endswith: '\Program Files\National Instruments\Shared\mDNS Responder\nimdnsNSP.dll '
    filter_optional_mcafee:
        FileNameBuffer|endswith:
            - '\Program Files\McAfee\Endpoint Security\Threat Prevention\MfeAmsiProvider.dll'
            - '\Program Files\McAfee\MfeAV\AMSIExt.dll'
    filter_optional_eset:
        FileNameBuffer|endswith: '\Program Files\ESET\ESET Security\eamsi.dll'
    filter_optional_comodo:
        FileNameBuffer|endswith: '\Program Files\comodo\comodo internet security\amsiprovider_x64.dll'
    filter_optional_sentinel_one:
        - FileNameBuffer|contains: '\Program Files\SentinelOne\Sentinel Agent'
        - ProcessNameBuffer|contains: '\Program Files\SentinelOne\Sentinel Agent'
    filter_optional_national_instruments:
        FileNameBuffer|contains: '\National Instruments\Shared\mDNS Responder\'
    filter_optional_kaspersky:
        - ProcessNameBuffer|contains|all:
              - '\Kaspersky Lab\'
              - '\avp.exe'
        - FileNameBuffer|contains|all:
              - '\Kaspersky Lab\'
              - '\antimalware_provider.dll'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Unknown
level: low