Windows Code Integrity Operational Logs: File Load Rejected for Unsatisfied Signing Level Requirements

title: "Windows Code Integrity Operational Logs: File Load Rejected for Unsatisfied Signing Level Requirements"
id: 8970180f-6fee-4ef6-8482-3b5702903804
status: experimental
description: This rule flags Windows Code Integrity operational events where a process attempted to load a file that did not meet the configured signing level requirements (or violated code integrity policy) and was potentially allowed only due to auditing policy. This behavior matters because loading non-compliant or revoked/expired signed binaries undermines application control and may indicate tampering or persistence attempts. It relies on Code Integrity operational telemetry with Event IDs 3033 and 3034, including the loading process, target file path, and the requested signing policy level.
references:
  - https://twitter.com/SBousseaden/status/1483810148602814466
  - https://github.com/MicrosoftDocs/windows-itpro-docs/blob/40fe118976734578f83e5e839b9c63ae7a4af82d/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md#windows-codeintegrity-operational-log
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/code_integrity/win_codeintegrity_attempted_dll_load.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-01-20
modified: 2025-02-28
tags:
  - attack.execution
logsource:
  product: windows
  service: codeintegrity-operational
detection:
  selection:
    EventID:
      - 3033
      - 3034
  filter_optional_dtrace:
    FileNameBuffer|endswith: \Program Files\DTrace\dtrace.dll
    ProcessNameBuffer|endswith: \Windows\System32\svchost.exe
    RequestedPolicy: 12
  filter_optional_av_generic:
    FileNameBuffer|contains: \Windows\System32\DriverStore\FileRepository\
    FileNameBuffer|endswith: \igd10iumd64.dll
    RequestedPolicy: 7
  filter_optional_electron_based_app:
    FileNameBuffer|endswith: \Windows\System32\nvspcap64.dll
    ProcessNameBuffer|endswith:
      - \AppData\Local\Keybase\Gui\Keybase.exe
      - \Microsoft\Teams\stage\Teams.exe
    RequestedPolicy: 8
  filter_optional_bonjour:
    FileNameBuffer|endswith: \Program Files\Bonjour\mdnsNSP.dll
    ProcessNameBuffer|endswith:
      - \Windows\System32\svchost.exe
      - \Windows\System32\SIHClient.exe
    RequestedPolicy:
      - 8
      - 12
  filter_optional_msoffice_1:
    FileNameBuffer|contains: \Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE
    FileNameBuffer|endswith: \MSOXMLMF.DLL
    RequestedPolicy: 7
  filter_optional_msoffice_2:
    ProcessNameBuffer|contains: \Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office
    FileNameBuffer|contains: \Windows\System32\
    RequestedPolicy: 8
  filter_optional_slack:
    FileNameBuffer|endswith: \Windows\System32\nvspcap64.dll
    ProcessNameBuffer|contains: \AppData\Local\slack\app-
    ProcessNameBuffer|endswith: \slack.exe
    RequestedPolicy: 8
  filter_optional_firefox:
    FileNameBuffer|endswith:
      - \Mozilla Firefox\mozavcodec.dll
      - \Mozilla Firefox\mozavutil.dll
    ProcessNameBuffer|endswith: \Mozilla Firefox\firefox.exe
    RequestedPolicy: 8
  filter_optional_avast:
    FileNameBuffer|endswith:
      - \Program Files\Avast Software\Avast\aswAMSI.dll
      - \Program Files (x86)\Avast Software\Avast\aswAMSI.dll
    RequestedPolicy:
      - 8
      - 12
  filter_main_gac:
    FileNameBuffer|contains: \Windows\assembly\GAC\
    ProcessNameBuffer|endswith: \mscorsvw.exe
    ProcessNameBuffer|contains: \Windows\Microsoft.NET\
    RequestedPolicy: 8
  filter_optional_google_drive:
    FileNameBuffer|contains: \Program Files\Google\Drive File Stream\
    FileNameBuffer|endswith: \crashpad_handler.exe
    ProcessNameBuffer|endswith: \Windows\ImmersiveControlPanel\SystemSettings.exe
    RequestedPolicy: 8
  filter_optional_trend_micro:
    FileNameBuffer|endswith: \Trend Micro\Client Server Security Agent\perficrcperfmonmgr.dll
    RequestedPolicy: 8
  filter_optional_mdns_responder:
    FileNameBuffer|endswith: "\\Program Files\\National Instruments\\Shared\\mDNS Responder\\nimdnsNSP.dll "
  filter_optional_mcafee:
    FileNameBuffer|endswith:
      - \Program Files\McAfee\Endpoint Security\Threat Prevention\MfeAmsiProvider.dll
      - \Program Files\McAfee\MfeAV\AMSIExt.dll
  filter_optional_eset:
    FileNameBuffer|endswith: \Program Files\ESET\ESET Security\eamsi.dll
  filter_optional_comodo:
    FileNameBuffer|endswith: \Program Files\comodo\comodo internet security\amsiprovider_x64.dll
  filter_optional_sentinel_one:
    - FileNameBuffer|contains: \Program Files\SentinelOne\Sentinel Agent
    - ProcessNameBuffer|contains: \Program Files\SentinelOne\Sentinel Agent
  filter_optional_national_instruments:
    FileNameBuffer|contains: \National Instruments\Shared\mDNS Responder\
  filter_optional_kaspersky:
    - ProcessNameBuffer|contains|all:
        - \Kaspersky Lab\
        - \avp.exe
    - FileNameBuffer|contains|all:
        - \Kaspersky Lab\
        - \antimalware_provider.dll
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Antivirus and other third party products are known to trigger this rule quite a lot. Initial filters and tuning is required before using this rule.
level: low
license: DRL-1.1
related:
  - id: f8931561-97f5-4c46-907f-0a4a592e47a7
    type: derived